SEC.co
Emergency
HIGH 7.3

CVE-2026-14722: TidGi-Desktop Code Injection via Git Repository Import (CVSS 7.3)

TidGi-Desktop, a desktop application for managing TiddlyWiki repositories, contains a code injection vulnerability affecting versions up to 0.13.0. An attacker can exploit this flaw remotely without authentication to inject and execute arbitrary code. Because exploit code has already been published, the risk of active attacks is elevated. The vulnerability exists in the Git Repository Import functionality, which processes wiki tiddlers from external sources.

Source data · NVD / CISA · public domain

CVSS
3.1 · 7.3 HIGH · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses (CWE)
CWE-74, CWE-94
Affected products
0 configuration(s)
Published / Modified
2026-07-05 / 2026-07-06

NVD description (verbatim)

A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The manipulation results in code injection. The attack may be performed from remote. The exploit has been made public and could be used.

6 reference(s) · View on NVD →

SEC.co analysis · AI-assisted, reviewed against source

Technical summary

CVE-2026-14722 is a code injection vulnerability (CWE-74, CWE-94) in TidGi-Desktop's wiki worker component, specifically in the loadWikiTiddlersWithSubWikis.ts file. The flaw allows remote attackers to inject code during the Git repository import process without requiring authentication or user interaction. The attack vector is network-based with low complexity, meaning an attacker can trigger it through standard HTTP requests or git operations. The vulnerability carries a CVSS 3.1 score of 7.3 (HIGH severity), reflecting impact to confidentiality, integrity, and availability.

Business impact

Organizations and individuals using TidGi-Desktop for collaborative wiki management face exposure to arbitrary code execution on affected systems. This could lead to data theft from wiki repositories, manipulation of wiki content, or lateral movement into corporate networks if the application runs with elevated privileges or on systems containing sensitive data. The public availability of exploit code significantly increases the likelihood of opportunistic attacks.

Affected systems

TidGi-Desktop versions 0.13.0 and earlier are affected. Users should verify their installed version through the application's about or settings menu. Desktop environments running Windows, macOS, or Linux with TidGi-Desktop installed are in scope.

Exploitability

This vulnerability is readily exploitable. It requires no user privileges or special credentials, can be triggered remotely over the network, and exploit code is publicly available. The low attack complexity and lack of authentication requirements make it attractive to automated scanning and mass exploitation attempts. However, exploitation still requires the target system to have TidGi-Desktop running and potentially configured to import from attacker-controlled repositories.

Remediation

Immediately upgrade TidGi-Desktop to a version later than 0.13.0. Check the TidGi-Desktop project repository or official release channels for the latest patched version. Until patching is complete, restrict Git repository imports to trusted sources only and disable auto-import features if available. Consider isolating systems running TidGi-Desktop that process untrusted wiki data.

Patch guidance

Navigate to the TidGi-Desktop GitHub repository or official download site to verify the latest available release version (verify against the vendor advisory to confirm the patched version number). Uninstall the current version and install the newer release. If auto-update is available within the application, enable it to prevent future delays in receiving security patches. Document the patched version across your inventory for compliance tracking.

Detection guidance

Monitor process execution logs for TidGi-Desktop spawning unusual child processes or accessing unexpected system resources during or after Git import operations. Network monitoring should flag TidGi-Desktop connecting to non-standard or suspicious repositories. File integrity monitoring on wiki data stores can detect unauthorized modifications. Watch for unexpected outbound connections from machines running TidGi-Desktop, as injected code may attempt command-and-control communication.

Why prioritize this

This vulnerability warrants immediate attention due to the combination of remote exploitability, public exploit availability, high CVSS score, and unrestricted attack surface (no authentication required). Although not yet on the CISA Known Exploited Vulnerabilities catalog, the published exploit code means defenders cannot rely on obscurity. Any organization or user running TidGi-Desktop should treat this as a priority patch.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a HIGH-severity vulnerability with network attack vector, low complexity, no privilege requirement, and no user interaction needed. The impact scope is unchanged but affects all three security properties: confidentiality (attacker can read wiki data), integrity (attacker can modify content or inject malware), and availability (attacker can disrupt or crash the application). The public exploit code further elevates practical risk beyond the base score.

Frequently asked questions

How do I know if my TidGi-Desktop is vulnerable?

Check your application version by opening TidGi-Desktop and navigating to the about or help menu. If your version is 0.13.0 or earlier, you are affected. Version numbers later than 0.13.0 should be patched; verify the exact patched version in the vendor's release notes.

Can this vulnerability be exploited if I only import from trusted repositories?

Restricting imports to trusted repositories reduces risk significantly but does not eliminate it entirely. An attacker could compromise a trusted repository or perform a man-in-the-middle attack to inject malicious code. Patching remains the primary mitigation.

What should I do if I think my system has been compromised?

Immediately isolate the affected system from the network. Review wiki data and system logs for signs of unauthorized modification or suspicious activity. Consider forensic analysis or endpoint detection and response (EDR) tools to identify any injected code or lateral movement. Patch the application and any other systems that may have been affected.

Is TidGi-Desktop widely used in enterprise environments?

TidGi-Desktop is primarily used by individuals and smaller teams managing TiddlyWiki instances with Git version control. Enterprise adoption is lower than mainstream applications, but the vulnerability still poses significant risk to any organization relying on it for knowledge management or collaborative documentation.

This analysis is based on publicly available vulnerability data current as of the publication date. Security teams must independently verify patch availability, affected product versions, and applicability to their specific environment. No exploit code is provided or endorsed. This explainer does not constitute formal risk assessment; organizations should conduct their own threat modeling based on asset criticality and exposure. Vendor advisories and security updates should be consulted directly for authoritative remediation guidance. Source: NVD (public-domain), retrieved 2026-08-13. Analysis generated by SEC.co (claude-haiku-4-5).

Weaknesses (CWE)

CWE-74CWE-94

Related vulnerabilities