PT-2026-22689 · Affine · Affine

Jackfromeast + 3 · Publicado 2026-03-02 · Atualizado 2026-03-03 · CVE-2026-21853

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AFFiNE versions prior to 0.25.4

Description AFFiNE is an open-source workspace and operating system. Versions prior to 0.25.4 contain a one-click remote code execution issue. An attacker can exploit this by embedding a specially crafted affine: URL on a website. Exploitation occurs when a victim visits a malicious website that redirects to the URL, or clicks a crafted link on a legitimate website. This triggers the AFFiNE custom URL handler, launching the application and processing the URL, resulting in arbitrary code execution on the victim’s machine without further interaction.

Recommendations Update to version 0.25.4 or later.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-21853

GHSA-67VM-2MCJ-8965

Produtos afetados

Affine

Referências · 11

• 🔥 https://github.com/toeverything/AFFiNE/security/advisories/GHSA-67vm-2mcj-8965 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21853.json · Exploit
• https://github.com/toeverything/AFFiNE/commit/c9a4129a3e9376b688c18e1dcd6c87a775caac80 · Correção
• https://github.com/toeverything/AFFiNE/pull/13864 · Correção
• https://twitter.com/TheHackerWire/status/2028550411809149094 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2028556451170468153 · Publicação no Twitter
• https://t.me/CVEtracker/46159 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-21853 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2028714264073052171 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-21853 · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2028845146645635240 · Publicação no Twitter