CVE-2025-67230

High

Published: 23/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allow attackers with renderer-context access to invoke external protocol handlers without sufficient validation.

Risk Assessment

An attacker could exploit this vulnerability to invoke dangerous external protocols, potentially leading to unauthorized actions on the user's system.

Recommendation

It is recommended to update ToDesktop Builder to the latest version and implement proper validation mechanisms for custom URL schemes.

Other vulnerabilities in ToDesktop Builder

CVE-2025-67229Critical
An improper certificate validation vulnerability in ToDesktop Builder v0.32.1 allows an unauthenticated on-path attacker to spoof backend responses by exploiting insufficient certificate validation.

Original NVD description (English source)

Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to invoke external protocol handlers without sufficient validation.