An issue in AppFlowy 0.11.8 allows aLaunchUri, _afLaunchLocalUri and OpenFilex.open functions, which are used to open URLs and local files. The flaw permits the attacker to supply malicious input that triggers unintended code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability is rooted in the lack of strict input validation before executing or opening the provided URI or file path and is classified as a command execution weakness.

The vulnerability affects the open‑source AppFlowy application, specifically version 0.11.8. Users running this release or earlier versions should be aware that the components responsible for launching URIs and local files are exposed to remote input and can be abused for code execution.

The CVSS score of 6.8 indicates a medium severity risk, reflecting the potential for arbitrary code execution if an attacker can trigger the vulnerable functions. EPSS is not available, so an exact exploitation probability cannot be quantified; however, the lack of input validation suggests a non‑negligible chance of attack in contexts where remote users can influence URI or file paths. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a remote attacker providing a crafted URI or local file path that is processed by afLaunchUri, _afLaunchLocalUri, or OpenFilex.open, leading to execution of unintended system commands.