{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71551 exists.","fix":"No fix has been published for CVE-2026-71551 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-71551 is a high-severity command injection vulnerability in super-productivity, published on 18 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-71551 and fix it if it is affected.\n\nWhat it is: CVE-2026-71551 is a high-severity command injection vulnerability in super-productivity, published on 18 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71551 exists.\n\nAffected product: super-productivity. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-71551/ (Markdown: https://insights.sbomify.com/CVE-2026-71551/index.md)","id":"CVE-2026-71551","markdown":"https://insights.sbomify.com/CVE-2026-71551/index.md","name":"CVE-2026-71551","record":{"aliases":["GHSA-256q-p9ff-jv8q"],"analysis":{"component_type":"desktop_application","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Super Productivity app","requires_auth":"none","summary":"Attackers can execute arbitrary OS commands via IPC handler in Super Productivity, bypassing confirmation dialogs through persistent whitelist settings.","user_interaction":"required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"description":"Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWED_COMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist","id":"CVE-2026-71551","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"command_injection","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS","id":"CVE-2026-71553"},"packages":[],"prev":{"headline":"OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters","id":"CVE-2026-71543"},"products":["super-productivity"],"published":"2026-08-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-21","vendors":["super-productivity"]},"summary":"Attackers can execute arbitrary OS commands via IPC handler in Super Productivity, bypassing confirmation dialogs through persistent whitelist settings.","url":"https://insights.sbomify.com/CVE-2026-71551/"}