Description

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWED_COMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-18T18:19:32.483Z",
  "pubdate": "2026-08-18T18:19:32.483Z",
  "executiveSummary": "Super Productivity prior to version 18.13.0 suffers from an arbitrary command execution vulnerability arising from insecure Inter-Process Communication (IPC) handling within the desktop application architecture.\nThe vulnerability allows untrusted renderer code, including dynamically evaluated community plugins executed via new Function(), to interact directly with system-level execution routines without verifying nodeExecution permissions.\nAn attacker capable of executing arbitrary code within the renderer process can leverage the exposed window.ea.exec() bridge to invoke arbitrary commands executed directly via child_process.exec() using the privileges of the underlying desktop user account.\nAlthough an initial execution triggers a confirmation dialog, the persistence checkbox is selected by default, causing approved commands to be automatically stored within the ALLOWED_COMMANDS configuration inside simpleSettings for subsequent silent execution.\nThis introduces significant risk by enabling persistent, unprompted system access through compromised or malicious plugins, ultimately leading to total host compromise.\nRemediation requires upgrading the affected application to version 18.13.0 or later, where the underlying IPC handler and permission validation models are properly secured.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure design of the EXEC IPC handler located in electron/ipc-handlers/exec.ts, which accepts an unvalidated command string originating from the renderer context and passes it directly to the Node.js child_process.exec() function.\nThis dangerous capability is exposed to the renderer environment via the bridge in electron/preload.ts, which maps the functionality to window.ea.exec().\nCrucially, this bridge makes the execution method accessible to all renderer components, including community plugins that are dynamically executed using new Function(), and does so without enforcing the nodeExecution permission check.\nThe attack flow proceeds as follows: an attacker introduces malicious code into the renderer context, either through a compromised dependency or a malicious community plugin.\nThe untrusted code invokes window.ea.exec() with a malicious command payload.\nUpon the initial execution attempt, a user-facing confirmation dialog is presented; however, the persistence mechanism is inherently flawed because the confirmation persistence checkbox is enabled by default.\nIf the user accepts the prompt, the command string is permanently stored in the ALLOWED_COMMANDS array within the simpleSettings storage mechanism.\nSubsequent executions of the stored command bypass user interaction entirely, allowing the payload to execute silently with the full privileges of the desktop user account.\nThe vulnerable component is the Electron IPC implementation handling execution tasks within Super Productivity versions prior to 18.13.0.\nThe vulnerability requires local renderer-level code execution capabilities—such as loading a malicious plugin—to trigger the IPC bridge, but it does not require authentication or elevated privileges beyond the standard desktop session."
}