Platform
other
Component
affine
Fixed in
0.25.5
CVE-2026-21853 describes a remote code execution (RCE) vulnerability in AFFiNE, an open-source workspace and operating system. This flaw allows attackers to execute arbitrary code by embedding a specially crafted 'affine:' URL. The vulnerability impacts versions of AFFiNE prior to 0.25.4 and can be triggered through malicious website redirects or crafted links within legitimate content. A patch is available in version 0.25.4.
The impact of this vulnerability is significant. An attacker can leverage it to execute arbitrary code on a victim's system simply by enticing them to visit a malicious website or click a crafted link. This could lead to complete system compromise, including data theft, malware installation, and further lateral movement within a network. The attack surface is broad, as the vulnerability can be exploited through user-controlled content, making it easy to distribute malicious links. The ability to execute arbitrary code grants the attacker near-complete control over the affected system, similar to the impact of other RCE vulnerabilities.
This CVE was published on 2026-03-02. No public proof-of-concept (PoC) has been released at the time of writing, but the ease of exploitation (simply requiring a crafted URL) suggests a potential for rapid exploitation if a PoC is developed. The CVSS score of 8.8 (HIGH) reflects the significant risk posed by this vulnerability. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.17% (38% percentile)
CISA SSVC
CVSS Vector
The primary mitigation is to upgrade to AFFiNE version 0.25.4 or later, which contains the fix. If immediate upgrading is not possible, implement URL filtering to block 'affine:' URLs from being processed. Educate users about the risks of clicking on suspicious links and visiting untrusted websites. Consider deploying a Web Application Firewall (WAF) to detect and block malicious requests containing crafted URLs. While a direct detection signature is difficult to create, monitoring for unusual process execution following URL clicks could be a useful indicator.
Actualice AFFiNE a la versión 0.25.4 o superior. Esta versión corrige la vulnerabilidad de ejecución remota de código a través de la gestión de URLs personalizadas. La actualización previene la ejecución de código arbitrario al visitar sitios web maliciosos o hacer clic en enlaces manipulados.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-21853 is a remote code execution vulnerability in AFFiNE versions prior to 0.25.4. Attackers can execute arbitrary code by crafting malicious 'affine:' URLs.
You are affected if you are using AFFiNE version 0.25.4 or earlier. Upgrade to 0.25.4 to mitigate the risk.
Upgrade to AFFiNE version 0.25.4 or later. As a temporary workaround, implement URL filtering and user awareness training.
While no active exploitation has been confirmed, the ease of exploitation suggests a potential for rapid exploitation if a public proof-of-concept is released.
Refer to the official AFFiNE security advisories on their website or GitHub repository for the latest information and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.