Executive brief
AppFlowy is an open-source productivity and collaboration platform similar to Notion. A vulnerability in its URI launching mechanism allows a remote attacker to execute arbitrary code by crafting a malicious URI that bypasses validation in the URL launcher components. This could enable attackers to compromise user systems and gain unauthorized control over affected installations.
Technical details
The vulnerability exists in AppFlowy 0.11.8's URI handling logic, specifically in the afLaunchUri and _afLaunchLocalUri functions (url_launcher.dart) and path validation in common_patterns.dart. The root cause appears to be insufficient validation of URI schemes and local file paths, allowing attackers to bypass security checks and execute arbitrary code through the OpenFilex.open interface. The attack vector is network-based and does not require authentication; an attacker can craft a malicious URI and deliver it to a victim, who may click it or have it automatically processed. Patches should address input validation and restrict allowed URI schemes and local file access.
Affected products
- AppFlowy AppFlowy 0.11.8
Timeline
- 2026-09-10: disclosed