CVE-2021-28119

9.8 criticalEPSS 3.6%

Critical (9.8) in twinkletray twinkle tray. EPSS 3.6% chance of exploitation in the next 30 days.

Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal API.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.6% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
Published: 2021-03-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

twinkletray:twinkle_tray

References

https://github.com/xanderfrangos/twinkle-tray/issues/142
https://github.com/xanderfrangos/twinkle-tray/issues/142

Check your stack JSON