CVE-2026-115904: Command Injection in Topluyo Linux

Topluyo Desktop Linux critical: Command Injection via URL. CVSS 9.6. Public PoC. Update to 2026.9.2410.

CVE-2026-115904 identifies a critical OS Command Injection vulnerability in Topluyo Desktop for Linux, versions prior to 2026.9.2410. The flaw resides in the openExternalLinks() function in the utils.js file, where attacker-controlled URLs are processed unsafely. This enables the execution of arbitrary operating system commands with the privileges of the user running the application.

The vulnerability is declared critical with a CVSS score of 9.6 according to official data. NVD published the advisory on October 28, 2026. On November 2, 2026, a public Proof of Concept (PoC) was released on GitHub, confirming the availability of working exploit demonstrations. The official patch was released in version 2026.9.2410.

System administrators must immediately update Topluyo Desktop to version 2026.9.2410 or later. If the application cannot be updated immediately, restrict the opening of links from untrusted sources and monitor process execution from Topluyo in your system logs. Check for any anomalous command executions originating from the application.

At a glance

What: OS Command Injection in openExternalLinks() function of Topluyo Desktop for Linux via unsecured URLs. Attacker executes arbitrary OS commands with privileges of the user running the application.
Severity: CVSS 9.6 (Critical). Arbitrary command execution with privileges limited to the local user running the application.
Affected versions: Topluyo Desktop for Linux prior to version 2026.9.2410. Versions from 2026.9.2410 onwards are patched.
Fix: Update to Topluyo Desktop 2026.9.2410 or later. Patch is already available from the vendor.
Status: CVE published on NVD on October 28, 2026. Public PoC available on GitHub since November 2, 2026. Official patch available.
Action: Update immediately to 2026.9.2410+. If not immediately possible, restrict URL sources and monitor system logs for anomalous processes.

Sources: NVD, CVE-2026-115904

← All articles