GHSA-vrrv-3f46-c3x7: Topluyo Desktop for Linux has an OS Command Injection issue

Published Oct 28, 2026

Updated

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Topluyo Desktop for Linux to a version that resolves this vulnerability.
Fixed in 2026.9.2410

Event History

Oct 28, 2026

CVE Published

via OSV·12:55 PM

Data Sourced

via OSV·12:55 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users running Topluyo Desktop for Linux versions earlier than 2026.9.2410 are exposed if they open a URL controlled by an attacker. Commands run with the privileges of the user running the application.

What does an attacker need to exploit the vulnerability?

The attacker needs control of a target URL and must cause the user to open that link in the application. No attacker authentication or local access is described.

Are users protected after updating?

Yes. Version 2026.9.2410 patches the unsafe processing of user-controlled URLs in the openExternalLinks() routine.

GHSA-vrrv-3f46-c3x7: Topluyo Desktop for Linux has an OS Command Injection issue

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are users protected after updating?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are users protected after updating?