CVE-2026-113411

Deferred Deferred - Pending Action

Improper Authorization in Nerimity Desktop via Custom URL Scheme

Publication date: 2026-10-20

Last updated on: 2026-10-22

Assigner: VulDB

Description

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-22

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113411

EUVD

EUVD-2026-105022

Affected Vendors & Products

Vendor	Product	Version / Range
Nerimity	Desktop	2.2.0
Nerimity	Desktop	2.2.1
Nerimity	Desktop	2.2.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-939	The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

Attack-Flow Graph

Executive Summary

This vulnerability affects Nerimity Desktop versions up to 2.2.2. It involves improper authorization in the handler for custom URL schemes due to the function shell.openExternal in src/mainWindow.js. The issue allows remote attackers to manipulate the url argument to execute unintended actions. A patch was released in version 2.3.3.

Detection Guidance

Check if your Nerimity Desktop version is below 2.3.3 by running commands like 'npm list nerimity-desktop' or checking the application version in settings. Inspect network traffic for unusual URL scheme handling or external link redirections.

Impact Analysis

An attacker could exploit this to run arbitrary commands or access files on your system by tricking the app into opening malicious URLs. This could lead to data theft, malware execution, or system compromise. Upgrading to version 2.3.3 or later mitigates this risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves improper authorization in handling custom URL schemes in Nerimity Desktop. However, if exploited, it could lead to unauthorized access to user data or system commands, which may indirectly impact compliance by violating data protection or security requirements.

Mitigation Strategies

Upgrade Nerimity Desktop to version 2.3.3 or later immediately. If upgrading is not possible, restrict custom URL scheme handling by modifying the application code to validate URLs before passing them to shell.openExternal().

Hi! I’m here to help you understand CVE-2026-113411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...