| 标题 | tiddly-gittly TidGi Desktop 0.13.0 TidGi Desktop 0.13.0 Remote Code Execution via Untrusted TiddlyW |
|---|
| 描述 | TidGi Desktop 0.13.0 allows arbitrary code execution when importing an untrusted TiddlyWiki repository.
The application automatically loads all .tid files from an imported workspace and subsequently boots the embedded TiddlyWiki instance. During the startup sequence, tiddlers containing the fields "type: application/javascript" and "module-type: startup" are automatically registered as executable modules and executed without sandboxing.
An attacker can craft a malicious repository containing a startup module that executes arbitrary Node.js code during workspace initialization. Successful exploitation requires a victim to import or clone the attacker-controlled repository through the application's workspace import functionality.
The vulnerability results in arbitrary command execution with the privileges of the current user. File read, file write, persistence mechanisms, and reverse shell execution are possible through access to Node.js built-in modules such as child_process and fs.
The issue has been acknowledged by the project maintainer, who indicated that sandboxing should be added to restrict execution of imported content. |
|---|
| 来源 | ⚠️ https://github.com/tiddly-gittly/TidGi-Desktop/security/advisories/GHSA-9hc2-hjx8-q6pv |
|---|
| 用户 | Fklov (UID 98102) |
|---|
| 提交 | 2026-06-04 12時34分 (1 月前) |
|---|
| 管理 | 2026-07-04 10時01分 (30 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 376309 [tiddly-gittly TidGi-Desktop 直到 0.13.0 Git Repository Import loadWikiTiddlersWithSubWikis.ts 权限提升] |
|---|
| 积分 | 20 |
|---|