CVE-2026-71551 super-productivity CVE debrief

Who should care

Defenders responsible for Super Productivity deployments should assess exposure and prioritize verification and remediation. This includes reviewing the current version, checking for any existing exploits, and planning for an upgrade to version 18.13.0 or later. Additionally, security teams should monitor for suspicious activity and review compensating controls for exposed systems.

Why it matters

A vulnerability in Super Productivity allows for command execution with the desktop account's privileges, requiring defenders to assess exposure and prioritize verification and remediation.

• Command execution with desktop account privileges
• Potential for lateral movement
• Need for verification and remediation
• Possible impact on productivity and data security

Technical summary

The EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins, without requiring nodeExecution permission. This allows for command execution with the desktop account's privileges, requiring defenders to assess exposure and prioritize verification and remediation. The vulnerability affects Super Productivity versions prior to 18.13.0, and defenders should prioritize verifying and upgrading to the latest version.

Defensive priority

Defenders should prioritize verifying and upgrading to version 18.13.0 or later, assessing exposure in their environment, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and upgrade to version 18.13.0 or later
• Assess exposure in your environment
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond upgrading to version 18.13.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.