CVE-2026-102539

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls synctrue before a user sets an encryption password, causing the operation-upload path to transmit and store all use...

CVE-2026-102539 Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls synctrue before a user sets an encryption password, causing the operation-upload path to transmit and store all use...

CVE-2026-102539 Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls synctrue before a user sets an encryption password, causing the operation-upload path to transmit and store all use...

CVE-2026-102539

The Super Productivity todo list app (versions 17.3.0 through 18.13.1 ) contains a vulnerability where the SuperSync end-to-end encryption setup transmits and stores user operations in plaintext before an encryption password is set. This occurs because the system calls sync(true) prematurely, pot...

CVE-2026-102539: Cleartext Storage of Sensitive Information

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls synctrue before a user sets an encryption password, causing the operation-upload path to transmit and store all use...

PT-2026-110961

Name of the Vulnerable Software and Affected Versions Super Productivity versions 17.3.0 through 18.13.0 Description The SuperSync end-to-end encryption E2EE setup calls the synctrue function before a user defines an encryption password. This causes the operation-upload path to transmit and store...

CVE-2026-71551

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...

EUVD-2026-61102

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...

CVE-2026-71551 Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...

CVE-2026-71551

The EXEC IPC handler in electron/ipc-handlers/exec.ts passes arbitrary commands via child_process.exec() without requiring nodeExecution permission. Community plugins run with new Function() can call window.ea.exec() to execute OS commands under the desktop account's privileges. The confirmation ...

CVE-2026-71551 Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...

CVE-2026-71551 Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...

PT-2026-77271

Name of the Vulnerable Software and Affected Versions Super Productivity versions prior to 18.13.0 Description The EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer via the IPC.EXEC channel and executes it using the child process.exec function. The...

CVE-2026-71551: Improper Neutralization of Special Elements used in an OS Command

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...