cherrytree vulnerabilities

1 known vulnerability in cherrytree from Giuspen. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  cherrytree: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-118692Oct 28, 2026Giuspen

  CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabl