PT-2026-118406

CVE-2026-113411

Published

2026-10-20

Updated

2026-10-20

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nerimity Desktop versions prior to 2.3.3

Description Improper authorization exists in the handler for custom URL schemes within the Window Open Handler component. A remote attacker can exploit this by manipulating the url argument passed to the shell.openExternal() function located in the src/mainWindow.js file.

Recommendations Upgrade to version 2.3.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Siyang Wu

Vendors

Affected products

Weakness enumeration

CWE-939: Improper Authorization in Handler for Custom URL Scheme

CWE-285: Improper Authorization