{"uuid": "7b06bf2c-1860-419e-94f4-f7832e007716", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-9hc2-hjx8-q6pv", "type": "seen", "source": "https://gist.github.com/alon710/2e36d4018e71382099203c9d78e54337", "content": "# GHSA-9HC2-HJX8-Q6PV: GHSA-9HC2-HJX8-Q6PV: Remote Code Execution in TidGi Desktop via Malicious TiddlyWiki Repository Import\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/GHSA-9HC2-HJX8-Q6PV\n\n## Summary\nA critical remote code execution vulnerability exists in TidGi Desktop up to version 0.13.0. The flaw allows an attacker to execute arbitrary code with Node.js privileges when a user imports or clones a malicious TiddlyWiki repository. This occurs due to the automatic execution of 'startup' modules defined in user-imported tiddler files.\n\n## TL;DR\nUnauthenticated remote code execution occurs when TidGi Desktop automatically registers and runs malicious startup modules found in imported TiddlyWiki repositories.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.6\n- **Exploit Status**: PoC\n- **KEV Status**: Not Listed\n- **Impact**: Remote Code Execution (RCE)\n\n## Affected Systems\n\n- TidGi Desktop\n- **TidGi Desktop**: <= 0.13.0 (Fixed in: `null`)\n\n## Mitigation\n\n- Verify the safety of third-party repositories before importing them into TidGi Desktop\n- Restrict allowed module-type metadata fields on imported user tiddlers\n- Evaluate user-imported JavaScript modules within a restricted virtual machine sandbox\n\n**Remediation Steps:**\n1. Manually review local .tid files for any unexpected 'module-type: startup' fields before loading folders\n2. Implement a security boundary check in 'defineTiddlerModules' to filter system-critical modules\n3. Configure virtual machine environments to evaluate third-party scripts without raw Node.js API access\n\n## References\n\n- [GitHub Security Advisory GHSA-9HC2-HJX8-Q6PV](https://github.com/advisories/GHSA-9HC2-HJX8-Q6PV)\n- [Vendor Security Advisory](https://github.com/tiddly-gittly/TidGi-Desktop/security/advisories/GHSA-9hc2-hjx8-q6pv)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-9HC2-HJX8-Q6PV) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-14T22:42:05.024270Z"}