What’s Vulnerable › Vulnerabilities

CVE-2023-49314

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-28 · updated 2026-06-17
• Weakness: CWE-94

Description

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.

Affected products

• Asana Desktop: 2.1.0

References

• https://asana.com/pt/download
• https://github.com/electron/fuses
• https://github.com/louiselalanne/CVE-2023-49314
• https://github.com/r3ggi/electroniz3r
• https://www.electronjs.org/blog/statement-run-as-node-cves
• https://www.electronjs.org/docs/latest/tutorial/fuses
• https://asana.com/pt/download
• https://github.com/electron/fuses
• https://github.com/louiselalanne/CVE-2023-49314
• https://github.com/r3ggi/electroniz3r
• https://www.electronjs.org/blog/statement-run-as-node-cves
• https://www.electronjs.org/docs/latest/tutorial/fuses

Get alerted when CVE-2023-49314 or the next vulnerability affects your stack