CVE-2026-21853

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21853", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T16:44:16.366Z", "datePublished": "2026-03-02T18:55:04.978Z", "dateUpdated": "2026-03-02T19:19:18.087Z"}, "containers": {"cna": {"title": "AFFiNE: One-click Remote Code Execution through Custom URL Handling", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/toeverything/AFFiNE/security/advisories/GHSA-67vm-2mcj-8965", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/toeverything/AFFiNE/security/advisories/GHSA-67vm-2mcj-8965"}, {"name": "https://github.com/toeverything/AFFiNE/pull/13864", "tags": ["x_refsource_MISC"], "url": "https://github.com/toeverything/AFFiNE/pull/13864"}, {"name": "https://github.com/toeverything/AFFiNE/commit/c9a4129a3e9376b688c18e1dcd6c87a775caac80", "tags": ["x_refsource_MISC"], "url": "https://github.com/toeverything/AFFiNE/commit/c9a4129a3e9376b688c18e1dcd6c87a775caac80"}], "affected": [{"vendor": "toeverything", "product": "AFFiNE", "versions": [{"version": "< 0.25.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-02T18:55:04.978Z"}, "descriptions": [{"lang": "en", "value": "AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerability. This vulnerability can be exploited by embedding a specially crafted affine: URL on a website. An attacker can trigger the vulnerability in two common scenarios: 1/ A victim visits a malicious website controlled by the attacker and the website redirect to the URL automatically, or 2/ A victim clicks on a crafted link embedded on a legitimate website (e.g., in user-generated content). In both cases, the browser invokes AFFiNE custom URL handler, which launches the AFFiNE app and processes the crafted URL. This results in arbitrary code execution on the victim\u2019s machine, without further interaction. This issue has been patched in version 0.25.4."}], "source": {"advisory": "GHSA-67vm-2mcj-8965", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T19:18:43.190650Z", "id": "CVE-2026-21853", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T19:19:18.087Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21853", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-02T19:18:43.190650Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T19:19:02.997Z"}}], "cna": {"title": "AFFiNE: One-click Remote Code Execution through Custom URL Handling", "source": {"advisory": "GHSA-67vm-2mcj-8965", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "toeverything", "product": "AFFiNE", "versions": [{"status": "affected", "version": "< 0.25.4"}]}], "references": [{"url": "https://github.com/toeverything/AFFiNE/security/advisories/GHSA-67vm-2mcj-8965", "name": "https://github.com/toeverything/AFFiNE/security/advisories/GHSA-67vm-2mcj-8965", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/toeverything/AFFiNE/pull/13864", "name": "https://github.com/toeverything/AFFiNE/pull/13864", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/toeverything/AFFiNE/commit/c9a4129a3e9376b688c18e1dcd6c87a775caac80", "name": "https://github.com/toeverything/AFFiNE/commit/c9a4129a3e9376b688c18e1dcd6c87a775caac80", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerability. This vulnerability can be exploited by embedding a specially crafted affine: URL on a website. An attacker can trigger the vulnerability in two common scenarios: 1/ A victim visits a malicious website controlled by the attacker and the website redirect to the URL automatically, or 2/ A victim clicks on a crafted link embedded on a legitimate website (e.g., in user-generated content). In both cases, the browser invokes AFFiNE custom URL handler, which launches the AFFiNE app and processes the crafted URL. This results in arbitrary code execution on the victim\u2019s machine, without further interaction. This issue has been patched in version 0.25.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-02T18:55:04.978Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21853", "state": "PUBLISHED", "dateUpdated": "2026-03-02T19:19:18.087Z", "dateReserved": "2026-01-05T16:44:16.366Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-02T18:55:04.978Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AFFiNE", "vendor": "toeverything", "versions": [{"status": "affected", "version": "< 0.25.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:affine:affine:*:*:*:*:*:*:*:*", "matchCriteriaId": "CCC113D1-6B87-4514-B83A-CB34A9108CD7", "versionEndExcluding": "0.25.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerability. This vulnerability can be exploited by embedding a specially crafted affine: URL on a website. An attacker can trigger the vulnerability in two common scenarios: 1/ A victim visits a malicious website controlled by the attacker and the website redirect to the URL automatically, or 2/ A victim clicks on a crafted link embedded on a legitimate website (e.g., in user-generated content). In both cases, the browser invokes AFFiNE custom URL handler, which launches the AFFiNE app and processes the crafted URL. This results in arbitrary code execution on the victim\u2019s machine, without further interaction. This issue has been patched in version 0.25.4."}, {"lang": "es", "value": "AFFiNE es un espacio de trabajo todo en uno de c\u00f3digo abierto y un sistema operativo. Antes de la versi\u00f3n 0.25.4, existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo de un solo clic. Esta vulnerabilidad puede ser explotada incrustando una URL affine: especialmente dise\u00f1ada en un sitio web. Un atacante puede activar la vulnerabilidad en dos escenarios comunes: 1/ Una v\u00edctima visita un sitio web malicioso controlado por el atacante y el sitio web redirige autom\u00e1ticamente a la URL, o 2/ Una v\u00edctima hace clic en un enlace dise\u00f1ado incrustado en un sitio web leg\u00edtimo (p. ej., en contenido generado por el usuario). En ambos casos, el navegador invoca el gestor de URL personalizado de AFFiNE, lo que inicia la aplicaci\u00f3n AFFiNE y procesa la URL dise\u00f1ada. Esto resulta en ejecuci\u00f3n de c\u00f3digo arbitrario en la m\u00e1quina de la v\u00edctima, sin interacci\u00f3n adicional. Este problema ha sido parcheado en la versi\u00f3n 0.25.4."}], "id": "CVE-2026-21853", "lastModified": "2026-06-17T10:19:01.960", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21853", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T19:18:43.190650Z", "version": "2.0.3"}}]}, "published": "2026-03-02T19:16:32.560", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/toeverything/AFFiNE/commit/c9a4129a3e9376b688c18e1dcd6c87a775caac80"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/toeverything/AFFiNE/pull/13864"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/toeverything/AFFiNE/security/advisories/GHSA-67vm-2mcj-8965"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.25.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AFFiNE", "source": "cna", "vendor": "toeverything"}, "product": "affine", "vendor": "toeverything"}], "analysis": {"en": {"generated_at": "2026-04-17T13:29:29.498020+00:00", "value": {"mitigation_remediation": ["Update AFFiNE to version 0.25.4 or later, which includes the fix for the custom URL handling flaw.", "If an upgrade cannot be performed immediately, block or sanitize affine: URLs by removing the custom URL handler from the operating system or changing browser settings to prevent automatic launch of AFFiNE via that scheme.", "Monitor web content for suspicious affine: URLs or redirects and consider disabling unsolicited URL handlers in browsers to reduce exposure."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the AFFiNE workspace application provided by toeverything. Any installation of AFFiNE earlier than version 0.25.4 is susceptible; the patch is included in version 0.25.4 and later. No additional affected versions are listed.", "description_and_impact": "A one\u2011click vulnerability in AFFiNE allows an attacker to craft a malicious affine: URL that, when opened by a victim\u2019s browser, triggers the AFFiNE custom URL handler to execute arbitrary code on the victim\u2019s machine without any further action. The flaw originates from improper validation of the URL payload and is classified as a command injection type weakness. Successful exploitation compromises confidentiality, integrity, and availability by giving the attacker full control over the affected system.", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity. The EPSS score of < 1% indicates a low exploitation probability, and the vulnerability is not listed in the KEV catalog. Despite the low likelihood, the high impact suggests organizations should address the flaw promptly but can accept a short grace period if patching cannot occur immediately."}}}}, "created": "2026-03-03T08:41:10.791371+00:00", "updated": "2026-04-17T13:30:19.610661+00:00", "vendors": ["toeverything", "toeverything$PRODUCT$affine"]}