CVE-2026-14722 - tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection

Back Back to CVE browser

MEDIUM

tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection

Published Jul 5, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.54%

Description

A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The manipulation results in code injection. The attack may be performed from remote. The exploit has been made public and could be used.

Affected products

Vendor Tiddly-Gittly Product TidGi-Desktop Default
n/a
- Version
  0.1
  Status
  affected
  Constraints
  -
- Version
  0.10
  Status
  affected
  Constraints
  -
- Version
  0.11
  Status
  affected
  Constraints
  -
- Version
  0.12
  Status
  affected
  Constraints
  -
- Version
  0.13.0
  Status
  affected
  Constraints
  -
- Version
  0.2
  Status
  affected
  Constraints
  -
- Version
  0.3
  Status
  affected
  Constraints
  -
- Version
  0.4
  Status
  affected
  Constraints
  -
- Version
  0.5
  Status
  affected
  Constraints
  -
- Version
  0.6
  Status
  affected
  Constraints
  -
- Version
  0.7
  Status
  affected
  Constraints
  -
- Version
  0.8
  Status
  affected
  Constraints
  -
- Version
  0.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tiddly-Gittly

TidGi-Desktop

n/a

Version	Status	Constraints
0.1	affected	-
0.10	affected	-
0.11	affected	-
0.12	affected	-
0.13.0	affected	-
0.2	affected	-
0.3	affected	-
0.4	affected	-
0.5	affected	-
0.6	affected	-
0.7	affected	-
0.8	affected	-
0.9	affected	-

Ecosystem	Package	Introduced	Fixed
npm	tidgi	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-94

Code Injection

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41735
Advisory
https://github.com/tiddly-gittly/TidGi-Desktop/
product
https://github.com/tiddly-gittly/TidGi-Desktop/security/advisories/GHSA-9hc2-hjx8-q6pv
exploit
https://vuldb.com/cve/CVE-2026-14722
third-party-advisory
https://vuldb.com/submit/847648
third-party-advisory
https://vuldb.com/vuln/376309
vdb-entry
https://vuldb.com/vuln/376309/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41735		Advisory
https://github.com/tiddly-gittly/TidGi-Desktop/		product
https://github.com/tiddly-gittly/TidGi-Desktop/security/advisories/GHSA-9hc2-hjx8-q6pv		exploit
https://vuldb.com/cve/CVE-2026-14722		third-party-advisory
https://vuldb.com/submit/847648		third-party-advisory
https://vuldb.com/vuln/376309		vdb-entry
https://vuldb.com/vuln/376309/cti		signaturepermissions-required