CVE-2026-113411 Details
Description
A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A remote code execution vulnerability exists in Nerimity Desktop versions through 2.2.2. The issue arises in the Window Open Handler, specifically within the shell.openExternal function in src/mainWindow.js. The vulnerability allows for improper authorization in handling custom URL schemes, as the application fails to validate URLs before opening them externally. This flaw can be exploited by sending a maliciously crafted URL that is not properly sanitized, leading to the execution of arbitrary commands on the user's system.
Users are advised to upgrade to Nerimity Desktop version 2.3.3, which addresses the vulnerability by validating URL schemes before opening external links. The latest version can be downloaded from the Nerimity GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LeoWSY-hashblue/cve-electron-2/blob/master/nerimity-desktop/cve.md | [email protected] | ExploitRemedyTechnical Analysis |
| https://github.com/Nerimity/nerimity-desktop/commit/f4df21bbc290f6c1956d899cf4da9e963074a6e4 | [email protected] | Source CodeVendor |
| https://github.com/Nerimity/nerimity-desktop/releases/tag/v2.3.3 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-113411 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1013190 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/422677 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/422677/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-939 | Improper Authorization in Handler for Custom URL Scheme | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nerimity Desktop | <= 2.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |