CVE-2026-71551: Super Productivity RCE Vulnerability

CVE-2026-71551 Overview

Super Productivity, an open-source todo and time tracking application, contains a command injection vulnerability in versions prior to 18.13.0. The EXEC Inter-Process Communication (IPC) handler in electron/ipc-handlers/exec.ts accepts arbitrary command strings from the renderer process and passes them to child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. This flaw is tracked as [CWE-78] OS Command Injection.

Critical Impact
A malicious community plugin or compromised renderer content can execute arbitrary operating system commands under the desktop user's account, achieving local code execution on the host.

Affected Products

Super Productivity desktop (Electron) versions prior to 18.13.0
Installations that load community plugins via new Function()
Any workflow relying on the IPC.EXEC channel exposed through window.ea.exec()

Discovery Timeline

2026-08-18 - CVE-2026-71551 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-71551

Vulnerability Analysis

Super Productivity's Electron main process registers an IPC.EXEC handler that forwards a renderer-supplied command string directly to Node.js child_process.exec(). The preload script exposes this handler as window.ea.exec() on the renderer's window object. Community plugins loaded through new Function() inherit this bridge and can invoke exec() without holding the nodeExecution permission that would normally gate native code execution.

A confirmation dialog fires the first time a command is requested, but its persistence checkbox is pre-selected. Approved commands are written to the ALLOWED_COMMANDS value in simpleSettings, allowing subsequent silent execution of the same command. This design collapses the security boundary between untrusted plugin JavaScript and the desktop user's shell.

Root Cause

The root cause is missing input validation and missing permission enforcement on a privileged IPC channel. The exec bridge should have required nodeExecution permission, restricted callers to trusted contexts, and avoided persisting a blanket allow-list keyed only on the command string.

Attack Vector

Exploitation requires local user interaction, typically installing or loading a malicious community plugin. Once loaded, the plugin calls window.ea.exec(cmd) from renderer JavaScript. The first invocation surfaces a confirmation dialog that a user may approve, and the default-checked persistence option silently authorizes future runs of that command string.

typescript

// Security patch in electron/electronAPI.d.ts
// fix(electron): remove exec IPC to close GHSA-256q (#8669)
   onSwitchTask(listener: (taskId: string) => void): void;

-  exec(command: string): void;
-
   consumePluginNodeExecutionApi(): PluginNodeExecutionElectronApi | null;

   // Plugin OAuth

typescript

// Security patch in electron/ipc-handler.ts
// fix(electron): remove exec IPC to close GHSA-256q (#8669)
 import {
   initAppControlIpc,
   initAppDataIpc,
-  initExecIpc,
   initGlobalShortcutsIpc,
   initJiraIpc,
   initSystemIpc,

Source: GitHub Commit 97e97042. The patch removes the exec binding from the Electron API surface and drops initExecIpc from IPC handler initialization, eliminating the vulnerable channel entirely.

Detection Methods for CVE-2026-71551

Indicators of Compromise

Unexpected entries in the ALLOWED_COMMANDS array inside the Super Productivity simpleSettings configuration file.
Child processes such as sh, bash, cmd.exe, or powershell.exe spawned by the Super Productivity Electron binary.
Community plugins referencing window.ea.exec or IPC.EXEC in their source.

Detection Strategies

Hunt endpoint process telemetry for Super Productivity spawning shell interpreters or living-off-the-land binaries.
Audit the simpleSettings store on managed workstations and flag any pre-existing ALLOWED_COMMANDS entries.
Review installed community plugins and static-scan their JavaScript for references to exec, child_process, or the IPC.EXEC channel.

Monitoring Recommendations

Alert on Super Productivity versions below 18.13.0 reported by software inventory tooling.
Monitor outbound network activity from processes launched by Super Productivity for signs of downloader or C2 behavior.
Track file writes to the Super Productivity configuration directory to detect tampering with simpleSettings.

How to Mitigate CVE-2026-71551

Immediate Actions Required

Upgrade Super Productivity to version 18.13.0 or later on all endpoints.
Inventory and remove any untrusted community plugins currently installed.
Clear the ALLOWED_COMMANDS array in simpleSettings to revoke previously approved commands.

Patch Information

The fix landed in Super Productivity 18.13.0 via GitHub Pull Request #8669 and commit 97e97042. The patch removes the exec IPC handler and the corresponding preload bridge. Full details are published in GitHub Security Advisory GHSA-256q-p9ff-jv8q.

Workarounds

Do not install community plugins from untrusted sources until upgrading.
Uncheck the persistence option in the exec confirmation dialog to prevent silent re-execution.
Restrict Super Productivity to standard user accounts without administrative privileges to limit blast radius.

bash

# Verify installed version and reset approved commands (Linux/macOS example)
super-productivity --version
# Locate and inspect the settings file for lingering ALLOWED_COMMANDS entries
grep -R "ALLOWED_COMMANDS" "$HOME/.config/superProductivity/"