CVE-2025-67230

High · 7.1

CVSS

7.1

EPSS

0.2%

Published

Jan 23, 2026

CISA due date

—

The record

Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to invoke external protocol handlers without sufficient validation.

Affected packages

Ecosystem	Package	Introduced	Fixed