---
id: CVE-2026-71551
title: >-
  Super Productivity is an advanced todo list app with integrated timeboxing and
  time tracking capabilities
summary: >-
  Super Productivity is an advanced todo list app with integrated timeboxing and
  time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in
  electron/ipc-handlers/exec.ts accepts a command string from the renderer
  through the IPC…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-08-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71551'
references:
  - url: >-
      https://github.com/super-productivity/super-productivity/commit/97e97042cde2e33524c9ad50dd46312c56be0072
    label: security-advisories@github.com
  - url: 'https://github.com/super-productivity/super-productivity/pull/8669'
    label: security-advisories@github.com
  - url: >-
      https://github.com/super-productivity/super-productivity/security/advisories/GHSA-256q-p9ff-jv8q
    label: security-advisories@github.com
  - url: >-
      https://github.com/super-productivity/super-productivity/security/advisories/GHSA-256q-p9ff-jv8q
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00221
epssPercentile: 0.11338
ingestedAt: '2026-09-18T20:51:25.636Z'
---

## Overview

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWED_COMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.