CVE-2026-0777
Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xmind. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of attachments. When opening an attachment, the user interface fails to warn the user of unsafe actions. An attacker can leverage this vulnerability to execute code in the context of current user. Was ZDI-CAN-26034.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.8
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS probability
- 0.34%
- CWE
- CWE-356
- Published
- 2026-02-20
- Last modified
- 2026-03-12
Affected products
- Xmind Xmind
Weakness type
Related vulnerabilities
- CVE-2026-25805 — Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.
- CVE-2025-3839 — Epiphany: insecure external protocol invocation in epiphany
- CVE-2025-14414 — Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability
- CVE-2025-14415 — Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability
- CVE-2025-14412 — Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability
- CVE-2025-14418 — pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability
- CVE-2025-14417 — pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability
- CVE-2025-14416 — pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability