Nextcloud · Nextcloud Desktop Client · CVE-2024-37885
**Name of the Vulnerable Software and Affected Versions**
Nextcloud Desktop Client versions prior to 3.12.0
**Description**
A code injection issue in the Nextcloud Desktop Client for macOS allows arbitrary code to be loaded when the client is started with the `DYLD INSERT LIBRARIES` environment variable set. This issue affects the synchronization of files from Nextcloud Server with the user's computer.
**Recommendations**
For versions prior to 3.12.0, upgrade the Nextcloud Desktop client to version 3.12.0 to resolve the issue. As a temporary workaround, consider restricting the use of the `DYLD INSERT LIBRARIES` environment variable until the upgrade is applied.