What is GHSA-x7ch-mhqx-6rv6?

GHSA-x7ch-mhqx-6rv6 is a security advisory published by GitHub Security Advisories with High severity. DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local...

Which CVE IDs does GHSA-x7ch-mhqx-6rv6 cover?

GHSA-x7ch-mhqx-6rv6 covers the following CVE IDs: CVE-2026-94540. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x7ch-mhqx-6rv6?

GHSA-x7ch-mhqx-6rv6 has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

GHSA-x7ch-mhqx-6rv6HighCVSS 7.7

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local...

Vendor

GitHub Security Advisories

Published

September 22, 2026

Last Modified

September 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-94540 →

📋 Description

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attacker-selected paired identity by interacting with the application's local service without any pairing confirmation or user interaction. Attackers can exploit the unauthenticated local service through same-device loopback to perform privileged SMS operations using the victim application's permissions.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-94540
https://github.com/actuator/net.mrpear.apps.desktopsmslite
https://www.vulncheck.com/advisories/desktopsms-unauthorized-access-via-local-service
https://github.com/advisories/GHSA-x7ch-mhqx-6rv6