AFFiNE: Exécution de code à distance en un clic via la gestion de l'URL personnalisée

The impact of this vulnerability is significant. An attacker can leverage it to execute arbitrary code on a victim's system simply by enticing them to visit a malicious website or click a crafted link. This could lead to complete system compromise, including data theft, malware installation, and further lateral movement within a network. The attack surface is broad, as the vulnerability can be exploited through user-controlled content, making it easy to distribute malicious links. The ability to execute arbitrary code grants the attacker near-complete control over the affected system, similar to the impact of other RCE vulnerabilities.

Users of AFFiNE, particularly those who rely on it for critical workflows or data storage, are at risk. Shared hosting environments where multiple users share the same AFFiNE instance are especially vulnerable, as a compromised user could potentially impact other users on the same server. Users who frequently interact with external websites or user-generated content are also at higher risk.

• linux / server: Monitor system logs for unusual process execution following URL clicks. Use journalctl to filter for AFFiNE-related events and suspicious command-line arguments.

journalctl | grep affine | grep -i "command injection"

• generic web: Inspect web server access logs for requests containing 'affine:' URLs. Look for patterns indicative of automated exploitation.

grep 'affine:' /var/log/apache2/access.log

• windows / supply-chain: Monitor PowerShell execution logs for AFFiNE processes launching suspicious commands. Use Windows Defender to create a custom detection rule for processes invoking AFFiNE with unusual arguments. • database (mysql, redis, mongodb, postgresql): N/A - This vulnerability does not directly impact databases. • wordpress / composer / npm: N/A - This vulnerability does not directly impact these platforms.

1. 2026-03-02Disclosure

   disclosure

1. Réservé2026-01-05
2. Publiée2026-03-02
3. EPSS mis à jour2026-03-23

The primary mitigation is to upgrade to AFFiNE version 0.25.4 or later, which contains the fix. If immediate upgrading is not possible, implement URL filtering to block 'affine:' URLs from being processed. Educate users about the risks of clicking on suspicious links and visiting untrusted websites. Consider deploying a Web Application Firewall (WAF) to detect and block malicious requests containing crafted URLs. While a direct detection signature is difficult to create, monitoring for unusual process execution following URL clicks could be a useful indicator.