{"id":"CVE-2026-14722","summary":"tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection","details":"A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The manipulation results in code injection. The attack may be performed from remote. The exploit has been made public and could be used.","aliases":["GHSA-9hc2-hjx8-q6pv"],"modified":"2026-07-15T01:49:01.617074071Z","published":"2026-07-05T07:30:08.357Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14722.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.3"},{"last_affected":"0.3"},{"introduced":"0.6"},{"last_affected":"0.6"}]}],"cna_assigner":"VulDB","cwe_ids":["CWE-74","CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/tiddly-gittly/TidGi-Desktop/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14722.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14722"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-14722"},{"type":"ADVISORY","url":"https://vuldb.com/submit/847648"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/376309"},{"type":"REPORT","url":"https://vuldb.com/vuln/376309/cti"},{"type":"EVIDENCE","url":"https://github.com/tiddly-gittly/TidGi-Desktop/security/advisories/GHSA-9hc2-hjx8-q6pv"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tiddly-gittly/tidgi-desktop","events":[{"introduced":"c360fb288c97ec8a2793a038778489c08e05bc2a"},{"last_affected":"def9e38f816c7654c2cb0918611d7fab2f941241"}],"database_specific":{"extracted_events":[{"introduced":"0.1"},{"last_affected":"0.1"},{"introduced":"0.2"},{"last_affected":"0.2"},{"introduced":"0.4"},{"last_affected":"0.4"},{"introduced":"0.5"},{"last_affected":"0.5"},{"introduced":"0.7"},{"last_affected":"0.7"},{"introduced":"0.8"},{"last_affected":"0.8"},{"introduced":"0.9"},{"last_affected":"0.9"},{"introduced":"0.10"},{"last_affected":"0.10"},{"introduced":"0.11"},{"last_affected":"0.11"},{"introduced":"0.12"},{"last_affected":"0.12"},{"introduced":"0.13.0"},{"last_affected":"0.13.0"}],"source":"AFFECTED_FIELD"}}],"versions":["0.1","0.10","0.11","0.12","0.13.0","0.2","0.4","0.5","0.7","0.8","0.9","v0.13.0","v0.13.0-prerelease25","v0.13.0-prerelease24","v0.13.0-prerelease23","v0.13.0-prerelease22","v0.13.0-prerelease21-fix","v0.13.0-prerelease21","v0.13.0-prerelease20","v0.13.0-prerelease19","v0.13.0-prerelease18","v0.13.0-prerelease17","v0.13.0-prerelease16","v0.13.0-prerelease15","v0.13.0-prerelease14","v0.13.0-prerelease13","v0.13.0-prerelease12","v0.13.0-prerelease11","v0.13.0-prerelease10","v0.13.0-prerelease9","v0.13.0-prerelease8","v0.13.0-prerelease7","v0.13.0-prerelease6","v0.13.0-prerelease5","v0.13.0-rc5","v0.13.0-prerelease4","v0.13.0-prerelease3","v0.13.0-prerelease2","v0.13.0-prerelease1","v0.12.4","v0.12.3","v0.12.2","v0.12.1-update","v0.12.1","v0.12.0-fix","v0.12.0","v0.11.3","v0.11.2","v0.11.1","v0.11.0-rc2","v0.11.0-rc1","v0.11.0","v0.10.4-prerelease","v0.10.3","v0.10.3-prerelease8","v0.10.3-prerelease7","v0.10.3-prerelease6","v0.10.3-prerelease5","v0.10.3-prerelease4","v0.10.3-prerelease3","v0.10.3-prerelease2","v0.10.3-prerelease1","v0.10.3-prerelease","v0.10.2","v0.10.1","v0.10.0-4","v0.10.0-3","v0.10.0-2","v0.10.0-1","v0.10.0","v0.9.6","v0.9.5","v0.9.4","v0.9.4-prerelease4-fix","v0.9.4-prerelease3-fix4","v0.9.4-prerelease3-fix3","v0.9.4-prerelease3-fix2","v0.9.4-prerelease3-fix","v0.9.4-prerelease4","v0.9.4-prerelease3","v0.9.4-prerelease2","v0.9.4-prerelease","v0.9.3","v0.9.2","v0.9.1","v0.9.1-prerelease","v0.9.0","v0.9.0-prerelease4","v0.9.0-prerelease3","v0.9.0-prerelease2","v0.9.0-prerelease1","v0.8.1-prerelease19","v0.8.1-prerelease18","v0.8.1-prerelease17","v0.8.1-prerelease16","v0.8.1-prerelease15","v0.8.1-prerelease14","v0.8.1-prerelease13","v0.8.1-prerelease12","v0.8.1-prerelease11","v0.8.1-prerelease10","v0.8.1-prerelease9","v0.8.1-prerelease8","v0.8.1-prerelease7","v0.8.1-prerelease5","v0.8.1-prerelease4","v0.8.1-prerelease3","v0.8.1-prerelease2","v0.8.1-prerelease1","v0.8.0","v0.8.0-prerelease15-fix2","v0.8.0-prerelease15-fix1","v0.8.0-prerelease15","v0.8.0-prerelease14","v0.8.0-prerelease13-fix2","v0.8.0-prerelease13-fix","v0.8.0-prerelease13","v0.8.0-prerelease12","v0.8.0-prerelease11","v0.8.0-prerelease10","v0.8.0-prerelease9","v0.8.0-prerelease8","v0.8.0-prerelease7","v0.8.0-prerelease6","v0.8.0-prerelease5","v0.8.0-prerelease4","v0.8.0-prerelease3","v0.8.0-prerelease2","v0.8.0-prerelease1","v0.7.15-prerelease4","v0.7.15-prerelease3-fix1","v0.7.15-prerelease3","v0.7.15-prerelease2-fix3","v0.7.15-prerelease2-fix2","v0.7.15-prerelease2-fix","v0.7.15-prerelease2","v0.7.15-prerelease","v0.7.14","v0.7.13-15","v0.7.13-14","v0.7.13-13","v0.7.13-12","v0.7.13-11","v0.7.13-10","v0.7.13-9","v0.7.13-8","v0.7.13-7","v0.7.13-6","v0.7.13-5","v0.7.13-4","v0.7.13-3","v0.7.13-2","v0.7.13-1","v0.7.13","v0.7.12-prerelease2","v0.7.12-prerelease","v0.7.11","v0.7.10","v0.7.10-prerelease1","v0.7.9","v0.7.8","v0.7.7","v0.7.7-prerelease4","v0.7.7-prerelease3","v0.7.7-prerelease2","v0.7.7-prerelease1","v0.7.6","v0.7.6-prerelease4.5","v0.7.6-prerelease4.4","v0.7.6-prerelease4.3","v0.7.6-prerelease4.2","v0.7.6-prerelease4.1","v0.7.6-prerelease4","v0.7.6-prerelease3.24","v0.7.6-prerelease3.23","v0.7.6-prerelease3.22","v0.7.6-prerelease3.21","v0.7.6-prerelease3.20","v0.7.6-prerelease3.19","v0.7.6-prerelease3.18","v0.7.6-prerelease3.17","v0.7.6-prerelease3.16","v0.7.6-prerelease3.15","v0.7.6-prerelease3.14","v0.7.6-prerelease3.13","v0.7.6-prerelease3.12","v0.7.6-prerelease3.11","v0.7.6-prerelease3.10","v0.7.6-prerelease3.9","v0.7.6-prerelease3.8","v0.7.6-prerelease3.7","0.7.6-prerelease3.7","v0.7.6-prerelease3.6","v0.7.6-prerelease3.5","0.7.6-prerelease3.5","v0.7.6-prerelease3.4","v0.7.6-prerelease3.3","v0.7.6-prerelease3.2","v0.7.6-prerelease3.1","v0.7.6-prerelease3","v0.7.6-prerelease2","v0.7.6-prerelease1","v0.7.5","v0.7.5-prerelease3","v0.7.5-prerelease2","v0.7.5-prerelease","v0.7.4","v0.7.4-prerelease4","v0.7.4-prerelease3","v0.7.4-prerelease","v0.7.3","v0.7.2-prerelease4","v0.7.2-prerelease3","v0.7.2-prerelease2","v0.7.2-prerelease","v0.7.1","v0.7.0","v0.6.6","v0.6.5","v0.6.5-a1","v0.6.4-fix5","v0.6.4-fix4","v0.6.4-fix3","v0.6.4-fix2","v0.6.4-fix1","v0.6.4","v0.6.3-fix1","v0.6.3","v0.6.2-fix1","v0.6.2","v0.6.1-prerelease5","v0.6.1-prerelease4","v0.6.1-prerelease3","v0.6.1-prerelease2","v0.6.1-prerelease","v0.5.4-prerelease4","v0.5.4-prerelease3","v0.5.4-prerelease2","v0.5.4-prerelease","v0.5.3","v0.5.2","v0.5.1","v0.5.1-prerelease4","v0.5.1-prerelease3","v0.5.1-prerelease2","v0.5.1-prerelease1","v0.5.0","v0.4.5","v0.4.4","v0.4.4-a1","v0.4.3","v0.4.3-a3","v0.4.3-a2","v0.4.3-a1","v0.4.2","v0.4.2-a8","v0.4.2-a7","v0.4.2-a6","v0.4.2-a5","v0.4.2-a4","v0.4.2-a3","v0.4.2-a2","v0.4.2-a1","v0.4.1","v0.4.1-a21","v0.4.1-a20","v0.4.1-a19","v0.4.1-a18","v0.4.1-a17","v0.4.1-a16","v0.4.1-a15","v0.4.1-a14","v0.4.1-a13","v0.4.1-a12","v0.4.1-a11","v0.4.1-a10","v0.4.1-a9","v0.4.1-a8","v0.4.1-a7","v0.4.1-a6","v0.4.1-a5","v0.4.1-a4","v0.4.1-a2","v0.4.1-a1","v0.4.0","v0.4.0-a8","v0.4.0-a7","v0.4.0-a6","v0.4.0-a5","v0.4.0-a4","v0.4.0-a3","v0.4.0-a2","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.2.1","v0.2.0","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14722.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}