CVE-2026-71551 in Super Productivity
Summary
by MITRE • 08/18/2026
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWED_COMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
Super Productivity is a productivity application that combines task management features such as todo lists and timeboxing with integrated time tracking capabilities, designed to help users manage their work efficiently within an Electron-based desktop environment. The security vulnerability identified involves the internal inter-process communication mechanism used by the application to handle system-level commands. Specifically, prior to version 18.13.0, the EXEC IPC handler located in the electron/ipc-handlers/exec.ts module was configured to accept command strings directly from renderer processes via the IPC.EXEC channel and execute them using Node.js child_process.exec(). This architectural design creates a significant security gap because it allows code running within the less privileged renderer context to trigger arbitrary operating system commands with the full privileges of the desktop account under which Super Productivity is executing.
The root cause of this vulnerability lies in how the application exposes its functionality to third-party extensions and custom scripts. The electron/preload.ts bridge script explicitly exposes a method named window.ea.exec() to renderer code, making it accessible to community plugins that are executed using new Function(). Crucially, this exposure does not require any specific nodeExecution permission or elevated security context from the user. This means that any plugin loaded by the application can invoke system commands without explicit authorization checks beyond what is implemented in the IPC handler itself. The lack of strict permission gating allows malicious or compromised plugins to interact directly with the operating system shell, bypassing standard sandbox restrictions typically enforced in Electron applications.
The operational impact of this flaw is severe due to the specific implementation details regarding user consent and command persistence. While a confirmation dialog was present for the first execution attempt, its protective value is significantly diminished by two critical design choices. First, the checkbox indicating whether to remember the approval is selected by default, encouraging users to bypass future prompts without careful consideration. Second, once an approved command is confirmed, it is stored in the ALLOWED_COMMANDS array within simpleSettings for silent later execution. This persistence mechanism means that a single initial interaction can establish a permanent backdoor, allowing subsequent executions of potentially dangerous commands without any further user intervention or awareness. Consequently, if a malicious plugin were to exploit this pathway, an attacker could achieve arbitrary code execution on the host system with the same privileges as the logged-in desktop user.
This vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection, as well as CWE-94 Improper Control of Generation of Code (Code Injection). From a threat modeling perspective using the MITRE ATT&CK framework, this flaw facilitates techniques related to Execution via Remote Services and potentially Defense Evasion if attackers use legitimate system utilities for malicious purposes. The ability to execute commands silently after initial approval also touches upon aspects of Persistence through configuration file modification or user preference storage. To mitigate this risk, users must upgrade immediately to version 18.13.0 where the issue has been resolved by tightening the IPC handler logic and ensuring that command execution requires proper permission validation rather than relying on default-selected consent dialogs. Administrators should also audit installed community plugins for any suspicious behavior until all instances of Super Productivity are updated, as existing installations remain vulnerable to exploitation through trusted plugin ecosystems.