CVE-2026-71551: Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWEDCOMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
electronto a version that resolves this vulnerability.Fixed in 18.13.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Desktop users running versions before 18.13.0 are exposed when renderer code can invoke the exposed window.ea.exec() bridge. Community plugins are specifically relevant because they are executed with new Function() and do not need nodeExecution permission to reach this capability.
What does an attacker need to exploit it?
An attacker needs code execution in the application's renderer context, such as through a community plugin, and user interaction for the initial command approval. The first confirmation can create persistent approval because the persistence checkbox is selected by default.
Why can the impact persist after the first approval?
The initial execution is guarded by a confirmation dialog, but commands approved with persistence are stored in the ALLOWED_COMMANDS simpleSettings value and can execute silently later with the desktop account's privileges.
What version contains the fix?
Upgrade Super Productivity to version 18.13.0, which fixes the issue. The supplied data does not identify a separate mitigation for installations that cannot be upgraded immediately.