CVE-2026-52103: SimpleX Chat RCE Vulnerability

CVE-2026-52103 Overview

CVE-2026-52103 is a zero-click remote code execution (RCE) vulnerability in SimpleX Chat versions before v6.5. The flaw resides in the /Terminal/Notification.hs component. Attackers can execute arbitrary commands in the context of the application by sending a crafted payload inside a text message. Exploitation requires no user interaction, making it particularly dangerous for messaging platforms where inbound messages arrive continuously.

Critical Impact
A single crafted text message triggers arbitrary command execution on the recipient's system without any click, tap, or acknowledgment from the target user.

Affected Products

SimpleX Chat versions before v6.5
SimpleX Chat Terminal client (Terminal/Notification.hs component)
Deployments relying on notification handling in the SimpleX Chat CLI

Discovery Timeline

2026-08-26 - CVE-2026-52103 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-52103

Vulnerability Analysis

The vulnerability sits in the notification handling logic of the SimpleX Chat terminal client. The Notification.hs module processes incoming message data and passes attacker-controlled content into an execution path without adequate sanitization. Because SimpleX Chat receives messages autonomously as part of normal client operation, the vulnerable code path executes as soon as a target message reaches the client. This yields command execution in the security context of the running application.

Zero-click exploitation removes the standard user-interaction barrier that limits many messaging client vulnerabilities. An attacker who knows a valid SimpleX address can send a single crafted text message and gain code execution on the recipient's host.

Root Cause

The root cause is unsafe handling of attacker-controlled data in the terminal notification pipeline. Message content that should be treated as inert text is interpreted or passed to a subsystem that evaluates it as a command. This pattern aligns with command injection weaknesses, where the trust boundary between untrusted input and a command interpreter is not enforced. Public technical details are limited; see the Te.mpe.st Disclosure Report for the researcher's analysis.

Attack Vector

Exploitation requires only the ability to send a message to a target SimpleX Chat user running an affected version. The attacker crafts a text message containing the malicious notification payload. Upon receipt, the terminal client processes the payload through the vulnerable Notification.hs code path, resulting in command execution under the privileges of the SimpleX Chat process. No user acknowledgment, message opening, or interaction is required.

No verified proof-of-concept code is currently published. See the Te.mpe.st Disclosure Report for additional technical context.

Detection Methods for CVE-2026-52103

Indicators of Compromise

Unexpected child processes spawned by the SimpleX Chat terminal binary
Outbound network connections initiated by the SimpleX Chat process to unfamiliar hosts shortly after inbound messages
New or modified files in the user's home directory or SimpleX configuration paths without corresponding user activity
Shell history entries or scheduled tasks created by the SimpleX Chat process context

Detection Strategies

Monitor process ancestry for SimpleX Chat spawning shells, interpreters, or system utilities such as sh, bash, curl, or wget
Alert on the SimpleX Chat process writing to autostart, cron, systemd user unit, or shell profile locations
Correlate inbound SimpleX message activity with subsequent process or filesystem events on the host

Monitoring Recommendations

Enable endpoint telemetry on hosts running SimpleX Chat terminal clients and retain process, file, and network events
Baseline normal SimpleX Chat process behavior so anomalous command execution or network egress is easier to surface
Review authentication logs and shell history on hosts where SimpleX Chat runs with elevated or shared user context

How to Mitigate CVE-2026-52103

Immediate Actions Required

Upgrade SimpleX Chat to version 6.5 or later on all affected terminal deployments
Inventory hosts running the SimpleX Chat CLI and prioritize systems exposed to untrusted contacts
Restrict the accounts under which SimpleX Chat runs so command execution cannot pivot to privileged operations
Review recent SimpleX Chat process activity on affected hosts for signs of prior exploitation

Patch Information

The vulnerability is fixed in SimpleX Chat v6.5. Users of versions prior to v6.5 must upgrade to receive the patched Terminal/Notification.hs implementation. Refer to the Te.mpe.st Disclosure Report and the SimpleX Chat project release notes for version guidance.

Workarounds

Stop or uninstall the SimpleX Chat terminal client on affected hosts until upgrade is possible
Limit inbound contact requests to trusted addresses to reduce exposure to attacker-crafted messages
Run SimpleX Chat inside a container, sandbox, or dedicated low-privilege user account to constrain the impact of exploitation
Apply outbound network egress controls on hosts running the terminal client to limit post-exploitation activity

bash

# Configuration example
# Verify installed SimpleX Chat terminal version and upgrade if below 6.5
simplex-chat --version

# Example: run SimpleX Chat under a dedicated low-privilege user
sudo useradd -m -s /bin/bash simplex
sudo -u simplex simplex-chat