CVE-2025-67230: 
NixOS vulnerability analysis and mitigation

CVE-2025-67230 is an improper permissions vulnerability in the Custom URL Scheme handler of ToDesktop Builder that allows attackers with renderer-context access to invoke external protocol handlers without sufficient validation. It affects ToDesktop Builder versions prior to 0.33.0 and was published on January 23, 2026. The vulnerability is classified under CWE-276 (Incorrect Default Permissions) and carries a CVSS v3.1 base score of 7.1 (High), as assessed by CISA-ADP (ToDesktop Advisory, Red Hat CVE).

The root cause is CWE-276 (Incorrect Default Permissions) in the URL scheme handler implementation within ToDesktop Builder, an Electron-based desktop application builder. ToDesktop Builder, like many Electron apps, uses a renderer process to display web content; the vulnerability arises because the handler for custom URL schemes does not enforce sufficient validation or access controls, allowing renderer-context code (e.g., malicious or compromised web content rendered within the app) to invoke arbitrary external protocol handlers. Exploitation requires the attacker to already have renderer-context access — for example, through a cross-site scripting flaw or malicious content loaded within the application — and also requires user interaction, making the attack complexity high (ToDesktop Advisory, Red Hat CVE).

Successful exploitation could allow an attacker to trigger unintended actions through custom URL schemes, potentially leading to unauthorized command execution or interaction with external applications installed on the host system. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, meaning a successful attack could result in data exposure, system compromise, or disruption of service. The scope is limited to the affected system (unchanged scope), but the ability to invoke arbitrary external protocol handlers could facilitate privilege escalation or lateral movement depending on the host environment (ToDesktop Advisory, Red Hat CVE).

There is no public proof-of-concept exploit available and no evidence of in-the-wild exploitation at this time. The EPSS score is extremely low at 0.0001, reflecting minimal current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires both renderer-context access and user interaction, which raises the bar for attackers (Red Hat CVE).

1. Gain renderer-context access: Identify or exploit a secondary vulnerability (e.g., XSS or content injection) within a ToDesktop Builder-packaged application running a version prior to 0.33.0 to execute JavaScript in the Electron renderer process.
2. Craft a malicious custom URL scheme invocation: From the renderer context, construct a call to a custom URL scheme (e.g., someprotocol://malicious-payload) that would normally be blocked or validated by a properly configured handler.
3. Trigger the handler: Invoke the URL scheme through renderer-accessible APIs (e.g., window.location, <a href> click, or shell.openExternal-equivalent calls) without the expected permission checks, bypassing the insufficient validation in the handler.
4. Achieve external protocol execution: The external protocol handler registered on the host OS (e.g., a URI handler for a third-party application) is invoked with attacker-controlled parameters, potentially triggering command execution or unintended application behavior.
5. Leverage for further compromise: Use the invoked external handler to execute commands, exfiltrate data, or interact with other installed applications to achieve the attacker's objective (ToDesktop Advisory).

ToDesktop has released a patch in ToDesktop Builder v0.33.0, which addresses the improper permissions in the Custom URL Scheme handler. Organizations and developers using ToDesktop Builder should upgrade to version 0.33.0 or later immediately. If immediate patching is not feasible, implement network-level controls to restrict access to ToDesktop Builder applications and monitor for suspicious external protocol handler invocations in the environment (ToDesktop Advisory, ToDesktop Changelog).

The vulnerability received standard automated coverage across CVE tracking platforms and security feeds shortly after publication in January 2026. Red Hat tracked the CVE in their security advisory database, and it was noted on Bluesky by automated CVE notification accounts. No significant researcher commentary, vendor statements beyond the official advisory, or notable media coverage has been identified (Red Hat CVE).