Description
A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The manipulation results in code injection. The attack may be performed from remote. The exploit has been made public and could be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tiddly-gittly | TidGi-Desktop | 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.10, 0.11, 0.12, 0.13.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | tidgi | <= 0.13.0 | — | GHSA-9hc2-hjx8-q6pv |
References
- VDB-376309 | tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection vdb-entry
- VDB-376309 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-14722 | CVE Analysis and Report third-party-advisory
- Submit #847648 | tiddly-gittly TidGi Desktop 0.13.0 TidGi Desktop 0.13.0 Remote Code Execution via Untrusted TiddlyW third-party-advisory
- https://github.com/tiddly-gittly/TidGi-Desktop/security/advisories/GHSA-9hc2-hjx8-q6pv exploit
- https://github.com/tiddly-gittly/TidGi-Desktop/ product