CVEvulnerability
CVE-2023-49314
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-11-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
Description
Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.
Affected configurations
• asana desktop 2.1.0
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://asana.com/pt/download Product
- https://github.com/electron/fuses Product
- https://github.com/louiselalanne/CVE-2023-49314 Third Party Advisory
- https://github.com/r3ggi/electroniz3r Product
- https://www.electronjs.org/blog/statement-run-as-node-cves www.electronjs.org
- https://www.electronjs.org/docs/latest/tutorial/fuses Technical Description
- https://asana.com/pt/download Product
- https://github.com/electron/fuses Product
- https://github.com/louiselalanne/CVE-2023-49314 Third Party Advisory
- https://github.com/r3ggi/electroniz3r Product
- https://www.electronjs.org/blog/statement-run-as-node-cves www.electronjs.org
- https://www.electronjs.org/docs/latest/tutorial/fuses Technical Description