| タイトル | tiddly-gittly TidGi Desktop 0.13.0 TidGi Desktop 0.13.0 Remote Code Execution via Untrusted TiddlyW |
|---|
| 説明 | TidGi Desktop 0.13.0 allows arbitrary code execution when importing an untrusted TiddlyWiki repository.
The application automatically loads all .tid files from an imported workspace and subsequently boots the embedded TiddlyWiki instance. During the startup sequence, tiddlers containing the fields "type: application/javascript" and "module-type: startup" are automatically registered as executable modules and executed without sandboxing.
An attacker can craft a malicious repository containing a startup module that executes arbitrary Node.js code during workspace initialization. Successful exploitation requires a victim to import or clone the attacker-controlled repository through the application's workspace import functionality.
The vulnerability results in arbitrary command execution with the privileges of the current user. File read, file write, persistence mechanisms, and reverse shell execution are possible through access to Node.js built-in modules such as child_process and fs.
The issue has been acknowledged by the project maintainer, who indicated that sandboxing should be added to restrict execution of imported content. |
|---|
| ソース | ⚠️ https://github.com/tiddly-gittly/TidGi-Desktop/security/advisories/GHSA-9hc2-hjx8-q6pv |
|---|
| ユーザー | Fklov (UID 98102) |
|---|
| 送信 | 2026年06月04日 12:34 (2 月 ago) |
|---|
| モデレーション | 2026年07月04日 10:01 (30 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 376309 [tiddly-gittly TidGi-Desktop 迄 0.13.0 Git Repository Import loadWikiTiddlersWithSubWikis.ts 特権昇格] |
|---|
| ポイント | 20 |
|---|