CVE-2024-23742

9.8 criticalEPSS 1.7%

Critical (9.8) in loom loom. EPSS 1.7% chance of exploitation in the next 30 days.

An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor disputes this because it requires local access to a victim's machine.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2024-01-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

loom:loom

References

https://github.com/V3x0r/CVE-2024-23742
https://www.electronjs.org/blog/statement-run-as-node-cves
https://github.com/V3x0r/CVE-2024-23742
https://www.electronjs.org/blog/statement-run-as-node-cves

Check your stack JSON