CVE-2019-17051

7.8 highEPSS 1.6%

High (7.8) in evernote evernote. EPSS 1.6% chance of exploitation in the next 30 days.

Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-click attack involving a drag-and-drop operation on a crafted Terminal file.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWE: CWE-732
Published: 2019-09-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

evernote:evernote

References

https://evernote.com/security/updates#MACOSNOTE-28956
https://www.youtube.com/watch?v=OG2tKlZX5bg
https://evernote.com/security/updates#MACOSNOTE-28956
https://www.youtube.com/watch?v=OG2tKlZX5bg

Check your stack JSON