CVE-2023-49314

7.8 highEPSS 4.3%

High (7.8) in asana desktop. EPSS 4.3% chance of exploitation in the next 30 days.

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.3% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2023-11-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

asana:desktop

References

https://asana.com/pt/download
https://github.com/electron/fuses
https://github.com/louiselalanne/CVE-2023-49314
https://github.com/r3ggi/electroniz3r
https://www.electronjs.org/blog/statement-run-as-node-cves

Check your stack JSON