CVE-2026-14722 Overview
CVE-2026-14722 is a code injection vulnerability in tiddly-gittly TidGi-Desktop versions up to 0.13.0. The flaw resides in the loadWikiTiddlersWithSubWikis.ts file within the Git Repository Import component. Attackers can trigger the vulnerability remotely by manipulating input processed during wiki tiddler loading from Git repositories. The vulnerability maps to [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Public exploit details have been disclosed, increasing the risk of opportunistic exploitation against exposed installations.
Critical Impact
Remote code injection through malicious Git repository content, enabling attackers to influence application behavior on systems running affected TidGi-Desktop versions.
Affected Products
- tiddly-gittly TidGi-Desktop versions up to and including 0.13.0
- Affected component: src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts
- Feature affected: Git Repository Import
Discovery Timeline
- 2026-07-05 - CVE-2026-14722 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-14722
Vulnerability Analysis
The vulnerability affects TidGi-Desktop, an Electron-based note-taking application that integrates TiddlyWiki with Git for version control. The Git Repository Import feature loads wiki tiddlers and sub-wikis from remote or local repositories through the loadWikiTiddlersWithSubWikis.ts module. Improper neutralization of repository-supplied data during this import process allows an attacker to inject code that the application later evaluates or executes. Because TidGi-Desktop runs on Electron, injected code can execute within the renderer or Node.js worker context, expanding the impact beyond the wiki content boundary. The GitHub security advisory GHSA-9hc2-hjx8-q6pv tracks the issue.
Root Cause
The root cause is classified under [CWE-74]: the application fails to properly neutralize special elements embedded in tiddler content or wiki configuration retrieved from Git repositories. When these elements reach a downstream interpreter, they change the intended parsing or execution flow. The loadWikiTiddlersWithSubWikis.ts routine trusts repository-controlled input paths and payloads without sufficient sanitization before passing them to code that constructs or evaluates dynamic behavior.
Attack Vector
Exploitation requires the victim to import or synchronize a Git repository controlled by the attacker. No authentication or user interaction beyond the import action is required at the application level. The attack proceeds over the network by publishing a crafted repository containing malicious tiddler files or sub-wiki definitions. When the victim performs the import, TidGi-Desktop parses the crafted content and processes the injected code. Public disclosure of exploit details means unpatched installations face elevated risk from opportunistic actors.
For exploitation specifics, refer to the GitHub Security Advisory GHSA-9hc2-hjx8-q6pv and the VulDB entry for CVE-2026-14722.
Detection Methods for CVE-2026-14722
Indicators of Compromise
- Unexpected child processes spawned by the TidGi-Desktop Electron process shortly after a Git import operation.
- New or modified files under the TidGi-Desktop working directory that do not correspond to legitimate tiddler edits.
- Outbound network connections from TidGi-Desktop to hosts unrelated to configured Git remotes.
- Import events referencing repositories from unverified or newly registered sources.
Detection Strategies
- Inspect Git clone and fetch activity performed by TidGi-Desktop for repositories added outside approved sources.
- Review tiddler content for template expressions, embedded scripts, or macros that call into system or shell interfaces.
- Correlate application launch events with subsequent process creation to identify anomalous execution chains.
Monitoring Recommendations
- Log Electron application child process creation on endpoints where TidGi-Desktop is installed.
- Monitor file system writes in user profile directories used by TidGi-Desktop for unexpected binaries or scripts.
- Alert on DNS or HTTPS traffic from TidGi-Desktop to non-corporate Git hosting providers.
How to Mitigate CVE-2026-14722
Immediate Actions Required
- Restrict imports in TidGi-Desktop to Git repositories from trusted, internally controlled sources only.
- Avoid opening or synchronizing wiki repositories received from untrusted third parties until a fixed release is applied.
- Inventory endpoints running TidGi-Desktop version 0.13.0 or earlier and prioritize them for update.
Patch Information
At the time of publication, no fixed version is referenced in the NVD entry for CVE-2026-14722. Monitor the TidGi-Desktop GitHub repository and the GHSA-9hc2-hjx8-q6pv advisory for the release containing the fix and apply it as soon as it becomes available.
Workarounds
- Disable the Git Repository Import feature or refrain from using it until a patched version ships.
- Vet repository contents in a sandboxed environment before importing them into a production TidGi-Desktop instance.
- Run TidGi-Desktop under a least-privilege user account to limit the impact of successful code injection.
# Example: verify installed TidGi-Desktop version before continued use
tidgi --version
# If output is 0.13.0 or lower, avoid importing untrusted Git repositories
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
