CVE-2026-113411: Nerimity Desktop Auth Bypass Vulnerability

CVE-2026-113411 Overview

CVE-2026-113411 is an improper authorization vulnerability [CWE-285] in Nerimity Desktop up to version 2.2.2. The flaw resides in the shell.openExternal call within the setWindowOpenHandler function in src/mainWindow.js. The Window Open Handler accepts any URL scheme without validation, allowing attackers to supply crafted URLs that invoke custom protocol handlers on the victim host. Exploitation requires user interaction but can be triggered remotely through content rendered inside the Electron-based chat client. A public exploit exists, and the vendor has published a fix in version 2.3.3.

Critical Impact

An attacker can craft a link that, when activated by a user, causes Nerimity Desktop to open arbitrary custom URL schemes handled by the operating system, enabling abuse of registered protocol handlers.

Affected Products

• Nerimity Desktop versions up to and including 2.2.2
• Component: Window Open Handler in src/mainWindow.js
• Fixed in Nerimity Desktop 2.3.3

Discovery Timeline

• 2026-10-20 - CVE-2026-113411 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113411

Vulnerability Analysis

Nerimity Desktop is an Electron application. The main process registers a window open handler using mainWindow.webContents.setWindowOpenHandler. The handler passes the incoming details.url directly to shell.openExternal without inspecting the URL scheme. Electron's shell.openExternal delegates URL handling to the host operating system, which routes custom schemes (for example file:, smb:, ms-msdt:, ssh:, or vendor-specific handlers) to their registered applications. Because no allowlist is applied, a remote actor who can place a link inside the application (such as a chat message, embedded image, or rendered attachment) can coerce the client into invoking any protocol handler the host has registered. The CWE-285 classification reflects the missing authorization check on the URL scheme before delegation to the OS. Exploitation requires the user to click or otherwise activate the attacker-supplied content.

Root Cause

The root cause is unconditional invocation of shell.openExternal(details.url) inside the window open handler. The handler does not parse the URL, does not restrict the protocol, and does not reject non-web schemes. Any string accepted by the OS as a URI is forwarded to the registered external handler.

Attack Vector

An attacker delivers a message or embedded element containing a URL with a dangerous custom scheme. When the victim interacts with it, Nerimity Desktop invokes the external handler, which can trigger auxiliary applications, leak NTLM credentials via UNC paths on Windows, or launch locally registered high-risk handlers.

// Security patch in src/mainWindow.js (commit f4df21bbc290f6c1956d899cf4da9e963074a6e4)
  });

  mainWindow.webContents.setWindowOpenHandler((details) => {
-    shell.openExternal(details.url);
+    try {
+      const parsedUrl = new URL(details.url);
+      if (parsedUrl.protocol === "https:" || parsedUrl.protocol === "http:") {
+        shell.openExternal(details.url);
+      }
+    } catch (err) {
+      //  invalid url
+    }
    return { action: "deny" };
  });

Source: GitHub commit f4df21b. The patch parses the URL and allows only http: and https: protocols to reach shell.openExternal.

Detection Methods for CVE-2026-113411

Indicators of Compromise

• Execution of child processes spawned by Nerimity.exe (or the platform equivalent) that correspond to protocol handlers such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
• Outbound SMB (TCP/445) connections initiated by the Nerimity Desktop process to untrusted hosts, consistent with UNC path abuse via file: URIs.
• Nerimity Desktop installations reporting a version string below 2.3.3.

Detection Strategies

• Hunt for process-ancestry chains where Nerimity Desktop is the parent of a known URI handler binary.
• Alert on invocation of registered custom protocol handlers that are high-risk (ms-msdt, search-ms, ssh, smb, file) sourced from any Electron chat client.
• Monitor endpoint telemetry for Nerimity Desktop writing or launching files from user-writable paths shortly after inbound message events.

Monitoring Recommendations

• Inventory installed versions of Nerimity Desktop and flag any instance earlier than 2.3.3.
• Capture command-line arguments for processes launched by Electron-based applications to detect handler abuse patterns.
• Track outbound network connections initiated by desktop chat clients and alert on non-standard destinations or protocols.

How to Mitigate CVE-2026-113411

Immediate Actions Required

• Upgrade Nerimity Desktop to version 2.3.3 or later on all endpoints.
• Review endpoint telemetry for suspicious child processes previously spawned by Nerimity Desktop.
• Advise users not to click untrusted links received through Nerimity until clients are upgraded.

Patch Information

The vendor fix is tracked in commit f4df21bbc290f6c1956d899cf4da9e963074a6e4 and shipped in Nerimity Desktop v2.3.3. The patch introduces URL parsing and restricts shell.openExternal to the http: and https: protocols. Additional background is available in the GitHub CVE documentation and VulDB CVE-2026-113411.

Workarounds

• Block execution of Nerimity Desktop versions earlier than 2.3.3 using application control policies until upgrades complete.
• Restrict or unregister high-risk custom protocol handlers (ms-msdt, search-ms, smb, file) at the OS level where operationally feasible.
• Enforce egress filtering to block SMB (TCP/445) from workstations to untrusted networks to limit UNC-based credential theft.

# Verify installed Nerimity Desktop version on Linux
nerimity-desktop --version

# Windows: query installed version via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Nerimity*" } |
  Select-Object DisplayName, DisplayVersion