Arbitrary command execution via renderer IPC exec

Command injection in Super Productivity before 18.13.0 allows attackers to execute OS commands via renderer-supplied IPC EXEC input. The electron/ipc-handlers/exec.ts handler forwards command strings from window.ea.exec() to child_process.exec(), so renderer code and community plugins can reach a system shell, and accepted commands are persisted in ALLOWED_COMMANDS for later silent reuse. Exploitation requires local user interaction to install or enable a malicious plugin and approve its first command, after which the desktop account's privileges are available to that plugin or any other code that reuses the whitelisted command.