CVE-2026-71551 - Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist
Brief
CVE ID : CVE-2026-71551
Published : Aug. 18, 2026, 6:19 p. m.
- 48 minutes ago
Description : Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.
- 0, the EXEC IPC handler in electron/ipc-handlers/exec. ts accepts a command string from the renderer through the IPC. EXEC channel and executes it with child_process. exec(). The electron/preload. ts bridge exposes window. ea.
exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWED_COMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.
- 0.
Severity: 7.8
- HIGH