Remote Code Execution Vulnerability in Discord for macOS
CVE-2024-23739

9.8CRITICAL

Key Information:

Vendor

Discord

Status
Discord
Vendor
CVE Published:
28 January 2024

Badges

👾 Exploit Exists🟣 EPSS 35%

What is CVE-2024-23739?

A vulnerability exists in Discord for macOS that enables remote attackers to execute arbitrary code. This occurs due to improper handling of the RunAsNode and enableNodeClilnspectArguments settings in versions 0.0.291 and earlier. Exploiting this flaw can lead to unauthorized access and potential compromise of the user's system. It is crucial for users to be aware of this issue and to take preventive measures by updating to the latest version of the application.

References

https://github.com/V3x0r/CVE-2024-23739
https://www.electronjs.org/blog/statement-run-as-node-cves

EPSS Score

35% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.