CVE-2026-113411

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-113411

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113411.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-113411

Published

2026-10-20T14:30:19Z

Modified

2026-10-21T02:55:54Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme

Details

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-285",
        "CWE-939"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113411.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.2.2"
                        },
                        {
                            "last_affected":  "2.2.2"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/nerimity/nerimity-desktop

Affected ranges

Type

GIT

Repo

https://github.com/nerimity/nerimity-desktop

Events

Introduced

fb9c56c9729ba5e61e92da21c65368d4d1286332

Last Affected

91dd5b10c78ed7b7a15fbe8529d38105084f37f2

Fixed

f4df21bbc290f6c1956d899cf4da9e963074a6e4

Fixed

5b946f330a5f43726c505fde45fadb58abbae77e

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.2.0"
                },
                {
                    "last_affected":  "2.2.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "2.2.1"
                },
                {
                    "last_affected":  "2.2.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "f4df21bbc290f6c1956d899cf4da9e963074a6e4"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v2.3.3",
            "range":  [
                {
                    "fixed":  "5b946f330a5f43726c505fde45fadb58abbae77e"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*

2.2.0

2.2.1

v2.*

v2.2.0

v2.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113411.json"