Protocol-handler RCE from a single malicious link in the Internxt Desktop app (Internxt Desktop)
The write-up was published 2026-10-02 with a working PoC, the fix has been merged for three months but no fixed release has shipped, and all installed copies (<=2.6.12) are exploitable by a single link click.
The Internxt desktop app registers the internxt:// protocol handler and its notification handler passes URLs to shell.openExternal without validation. A victim clicking a crafted link such as internxt://notification/file:///C:/Windows/System32/calc.exe causes the app to launch an attacker-chosen target, giving remote code execution on Windows, macOS and Linux. The researcher also documents structural crypto weaknesses (unauthenticated public keys, mnemonic key leakage via URL path, MD5-based password protection) that could leak long-term encryption keys. No CVE and no public vendor advisory; the vendor privately told the author a v2.7 fix is forthcoming.
Affected: Internxt Desktop app version 2.6.12 and earlier; v2.7 said by the vendor to be forthcoming but not yet shipped
How to Test
Check your installed Internxt desktop app version (Help/About); 2.6.12 and earlier are affected. To test exposure, confirm the app registered the internxt:// protocol handler and whether clicking an internxt://notification/... link launches an external target. Watch for unexpected child processes spawned by the Internxt app after link clicks.
How to Mitigate
There is no shipped fix as of this writing, so remove or stop using the app, or deregister/block the internxt:// protocol handler and avoid clicking internxt:// links; install v2.7 immediately once the vendor releases it.