Topluyo Desktop: command injection

Topluyo

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks() routine in utils.js.

Do this now

Upgrade Topluyo Desktop for Linux to 2026.9.2410 or later, the fixed version.

Fix it

Upgrade to App 2026.9.2410

First seen: 2 Nov 2026
Last update: 2 Nov 2026, 12:17 UTC
Fixed in: 2026.9.2410
Identifiers: CVE-2026-115904
CVSS: 9.6
Source: news
On the menu as: Chat apps

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Topluyo Desktop: command injection
Severity: critical. Patch status: patched.
Affected: Topluyo
Fixed in: 2026.9.2410
Ids: CVE-2026-115904

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks() routine in utils.js.

## Steps
1. Search the repo, its CI and infra config for Topluyo. If present, report the version in use and whether it's affected.
2. Fix by release line: App: older than 2026.9.2410 → 2026.9.2410.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| App older than 2026.9.2410 | fixed | 2026.9.2410 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-115904") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/topluyo/App/security/advisories/GHSA-vrrv-3f46-c3x7 https://nvd.nist.gov/vuln/detail/CVE-2026-115904
https://pwned.coffee/i/topluyo-desktop-command-injection-cve-2026-115904

Timeline

2 Nov 2026, 12:17 UTC
Fix status: unknown → patched.
2 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Checked by hand “The CVE record calls Topluyo a social networking platform; chat apps is the nearest menu entry.” source
Fix by release line: Product Affected Fixed in Source
App <2026.9.2410 2026.9.2410 GitHub advisory checked 3 Nov
Score: CVSS 9.6 (critical). CVSS 3.1 9.6 (CNA GitHub_M) for CVE-2026-115904
Last checked: 4 Nov 2026, 08:18 UTC

Product	Affected	Fixed in	Source
App	<2026.9.2410	2026.9.2410	GitHub advisory checked 3 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee