Based on the description, it is inferred that the vulnerability allows an attacker to open malicious URLs via the custom URL scheme. A flaw exists in Nerimity Desktop up to version 2.2.2 in the shell.openExternal function of src/mainWindow.js, the Window Open Handler. The vulnerability allows an attacker to craft a malicious URL for the custom URL scheme, thereby bypassing the expected authorization checks. Exploitation can be performed remotely, and the malicious URL will be opened by the user's default application, potentially allowing arbitrary command execution or other unintended actions.

Nerimity Desktop, versions up to 2.2.2. The issue is fixed in version 2.3.3 and later releases. Users of any earlier version are vulnerable. Users of 2.3.3 or newer are not affected by this flaw.

Based on the description, it is inferred that the exploit can be executed remotely and may lead to arbitrary command execution. The CVSS score of 5.3 categorizes this as a moderate risk vulnerability. Because the exploit is public and can be executed remotely, the threat landscape is significant even without a high CVSS. The absence of an EPSS score does not negate the practical risk, as demonstrated by the release of a working exploit. The vulnerability is not listed in the CISA KEV catalog, but the remote exploitation potential and public availability warrant prompt action.