This flaw resides in the attachment handling code of Xmind. The user interface does not warn users when an attachment contains potentially unsafe actions, allowing an attacker to execute arbitrary code in the context of the current user. The vulnerability is actionable only when a user visits a malicious web page or opens a malicious file, giving the attacker the ability to run shell commands or install malware.

The affected system is Xmind for all installed versions. No specific release or version information is disclosed in the advisory, which means that any installation of Xmind that has not applied an official update may be vulnerable.

The CVSS metric scores this issue as high (7.8), reflecting the potential for complete compromise of the user’s system. The EPSS score is below 1%, indicating that exploitation attempts are currently rare or low likelihood. The vulnerability is not listed in the CISA Known Exploit Vulnerabilities catalog. The attack surface requires user interaction – a malicious page that triggers the attachment viewer or a crafted attachment. Once the user opens the file or page, code runs with the privileges of the user, which can lead to full system compromise.