super-productivity CVE debriefs

CVE-2026-71551

A vulnerability in Super Productivity, a todo list app with timeboxing and time tracking capabilities, allows for command execution with the desktop account's privileges. The EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer [truncated]