CVE-2026-113411

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

• CWE-285
• CWE-939

• https://github.com/LeoWSY-hashblue/cve-electron-2/blob/master/nerimity-desktop/cve.md
• https://github.com/Nerimity/nerimity-desktop/commit/f4df21bbc290f6c1956d899cf4da9e963074a6e4
• https://github.com/Nerimity/nerimity-desktop/releases/tag/v2.3.3
• https://vuldb.com/cve/CVE-2026-113411
• https://vuldb.com/submit/1013190
• https://vuldb.com/vuln/422677
• https://vuldb.com/vuln/422677/cti

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113403ArmorX Spam developed by ArmorX Global Technology has a Comm…6.5
• CVE-2026-113404WebITR developed by Uniong has a Insecure Deserialization vu…8.8
• CVE-2026-113405BA-Workflow developed by YS-infoware has a SQL Injection vul…8.8
• CVE-2026-113406BA-Workflow developed by YS-infoware has a SQL Injection vul…8.8
• CVE-2026-113407BA-Workflow developed by YS-infoware has a SQL Injection vul…8.8
• CVE-2026-11341A flaw has been found in D-Link DWR-M920 up to 1.1.50. The i…6.3
• CVE-2026-11342A vulnerability has been found in code-projects Hotel and To…7.3
• CVE-2026-11344A vulnerability was found in code-projects Vehicle Managemen…7.3
• CVE-2026-113442Values entered by visitors were placed into the HTML summary…5.3
• CVE-2026-11345An Improper Authentication vulnerability in the /api/Cdn/Get…6.9
• CVE-2026-113459In versions running on TYPO3 10 and 11, the configured OpenA…7.1
• CVE-2026-11346A Server-Side Request Forgery (SSRF) vulnerability in the cu…5.3