A high-severity vulnerability in ToDesktop Builder v0.33.0 allows authenticated attackers with renderer access to execute external protocol handlers, posing a significant risk of unauthorized system interaction.

This issue is characterized by improper permission handling within the Custom URL Scheme handler. Attackers who have already achieved renderer-context access can leverage this flaw to trigger external protocol handlers without the necessary security validation.

The ability to invoke external protocol handlers can lead to unauthorized execution of system commands or navigation to malicious URIs, potentially resulting in full compromise of the application environment. With a CVSS score of 7.1, the risk is categorized as High, reflecting the potential for significant impact on confidentiality, integrity, and availability if an attacker gains control over the renderer process.

Immediate Action: Update ToDesktop Builder to the latest version as specified in the official vendor advisory at https://www.todesktop.com/security/advisories/TDSA-2025-002.

Proactive Monitoring: Review application access logs for unusual patterns related to external protocol invocations or unexpected calls to the Custom URL Scheme handler.

Compensating Controls: Ensure that the underlying operating system and browser environments are hardened to restrict unauthorized protocol handler execution, and employ endpoint protection to detect anomalous process behavior.

Public Exploit Available: No (exploit_available: false).

Given the High severity of this flaw and the potential for unauthorized system interactions, organizations using ToDesktop Builder should prioritize applying the vendor provided security updates immediately. Verify that all development environments are running the patched version to prevent potential exploitation of the Custom URL Scheme handler.