CVE-2026-71551
Received Received - Intake

Command Injection in Super Productivity Desktop App

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWED_COMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-71551
EUVD
EUVD-2026-61102

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
super_productivity super_productivity 18.13.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71551 is a high-severity vulnerability in Super Productivity, an Electron-based todo app. It allows arbitrary shell command execution through a vulnerable IPC handler that accepted commands from the renderer process via the IPC.EXEC channel. The handler used child_process.exec() without proper sanitization, enabling attackers to run malicious commands with the user's privileges. A confirmation dialog with a default-checked persistence option whitelisted approved commands for silent future execution.

Detection Guidance

Check for Super Productivity versions prior to 18.13.0. Look for unexpected command executions in logs or system activity. Inspect renderer processes for calls to window.ea.exec() or IPC.EXEC channels. Monitor for whitelisted commands in simpleSettings files.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your system with the privileges of the user running Super Productivity. This could lead to file theft, malware installation, system modifications, or data exfiltration. Attackers could chain commands using shell metacharacters to perform multiple malicious actions silently after initial exploitation.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's integrity and confidentiality principles and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations, regulatory fines, and reputational damage due to insufficient protection against command injection attacks.

Mitigation Strategies

Upgrade Super Productivity to version 18.13.0 or later. Remove any whitelisted commands in simpleSettings. Disable or audit plugins that may interact with IPC handlers. Block unauthorized renderer process access to system commands.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71551. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart