What’s Vulnerable › Vulnerabilities

CVE-2022-26877

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-09 · updated 2026-06-17
• Weakness: CWE-552

Description

Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app into loading a malicious web page.

Affected products

• Asana Desktop: before 1.6.0 — fixed in 1.6.0

How to fix

Upgrade to a fixed version: Asana Desktop 1.6.0. Check the vendor advisory for mitigations.

References

• https://asana.com
• https://forum.asana.com/t/asana-desktop-app-security-update/160477
• https://asana.com
• https://forum.asana.com/t/asana-desktop-app-security-update/160477

Get alerted when CVE-2022-26877 or the next vulnerability affects your stack