CVE-2021-28119: Twinkletray Twinkle Tray

Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days.

Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal API.

Affected products

• Twinkletray Twinkle Tray: up to and including 1.13.3

Published 2021-03-09. Last modified 2026-06-17.