Topluyo Desktop for Linux has an OS Command Injection issue
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2026.9.2410
- Public exploit
- None on Exploit-DB
Summary
Topluyo Desktop for Linux, a client for the Topluyo social networking platform, is affected by this flaw. An attacker who can supply a link that the app opens could run arbitrary system commands with the same privileges as the logged-in user.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
Affected versions
- topluyo App
fixed in 2026.9.2410