CVE-2026-21853 is a one-click remote code execution vulnerability affecting AFFiNE, an open-source workspace, in versions prior to 0.25.4. This high-severity vulnerability (CVSS 8.8) allows an attacker to execute arbitrary code on a victim's machine by embedding a specially crafted affine: URL on a malicious website or a legitimate site with user-generated content. The attack requires user interaction, such as visiting a malicious site or clicking a crafted link, but then proceeds without further interaction. There is no evidence of active exploitation, nor are there public exploit modules available, though it has garnered some community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.25.4CPE matchmatch criteria | cpe:2.3:a:affine:affine:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.