CVE-2026-71551

Name of the Vulnerable Software and Affected Versions Super Productivity versions prior to 18.13.0

Description The EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer via the IPC.EXEC channel and executes it using the child process.exec() function. The electron/preload.ts bridge exposes the window.ea.exec() function to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. While a confirmation dialog exists for the first execution, its persistence checkbox is enabled by default, and approved commands are stored in the ALLOWED COMMANDS value within simpleSettings, allowing subsequent silent execution with the privileges of the desktop account.

Recommendations Update to version 18.13.0.