vulnti.work

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command st…

高危 CVSS 7.8
CVECVE-2026-71551
首次发现2026-08-21 05:15 UTC
披露时间2026-08-18 18:19 UTC
最后更新2026-08-21 05:15 UTC
通道状态auto

摘要

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protect…

中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。

深度研判

该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。

数据来源

  • NVD DATABASE

原始链接

时间线

  1. nvd_ingest NVD