CVE-2026-71551 Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist
Attackers can execute arbitrary OS commands via IPC handler in Super Productivity, bypassing confirmation dialogs through persistent whitelist settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-71551?
CVE-2026-71551 is a high-severity command injection vulnerability in super-productivity, published on 18 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWED_COMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0.
Weakness: CWE-78
Which versions are affected by CVE-2026-71551?
How do I fix CVE-2026-71551?
No fix has been published for CVE-2026-71551 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-71551 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71551 exists.
Sources
Also known as GHSA-256q-p9ff-jv8q.