AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T21:22:04.409Z and has not been modified since then. Super Productivity's SuperSync E2EE setup transmitted and stored user operations in plaintext before a user sets an encryption password. This issue is fixed in version 18.13.1. The vulnerability affects users of Super Productivity versions betwe [truncated]
A vulnerability in Super Productivity, a todo list app with timeboxing and time tracking capabilities, allows for command execution with the desktop account's privileges. The EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer [truncated]
