The vulnerability in Super Productivity allows renderer code or loaded plugins to send arbitrary shell commands through the IPC.EXEC channel, which the Electron main process executes using child_process.exec without restricting the command string. Because the result is stored in a persistent ALLOWED_COMMANDS list, approved commands can later run silently with the user’s desktop privileges, enabling a local attacker to rewrite files, exfiltrate data, or install malware. The weakness is a classic operating‑system command injection (CWE‑78).

Super Productivity by super‑productivity. Versions before 18.13.0 are affected; 18.13.0 and later include the fix that sanitizes commands and removes the persistent whitelist.

The CVSS score of 7.8 indicates high severity. EPSS data are not available, so the exploitation likelihood cannot be quantified, but the flaw exists in the main process and can be triggered from renderer code without special permissions. The attacker does not need elevated rights to inject commands; the execution runs with the desktop account’s privileges. The flaw is not listed in the CISA KEV catalog, yet its impact warrants immediate attention. The likely attack path is through local code execution or malicious Electron plugins that call window.ea.exec.