Executive brief
SimpleX Chat is a decentralized encrypted messaging application with a terminal/CLI client. A critical zero-click remote code execution vulnerability in the notification system allows attackers to execute arbitrary commands on a user's machine by sending a specially crafted message, without any user interaction required. An attacker can gain full system access to a device simply by sending a message to a user who has notifications enabled.
Technical details
The vulnerability is a shell command injection in the /Terminal/Notification.hs component of SimpleX Chat's terminal client. The code constructs shell commands by concatenating user-controlled message content (title and text from incoming chat messages) with insufficient escaping of shell metacharacters, then passes the resulting string to System.Process.shell. The escaping routines are incomplete and bypassable across Linux, macOS, and WSL platforms. An attacker can inject shell metacharacters via a crafted message to break out of the intended command context and execute arbitrary commands with the privileges of the SimpleX client process. No user interaction is required—the RCE triggers automatically when the message notification is processed. The vulnerability was fixed in SimpleX Chat v6.5, released April 30, 2026.
Affected products
- SimpleX Chat before v6.5
Timeline
- 2026-02-25: disclosed
- 2026-04-30: patched: Fixed in v6.5