PT-2024-20050 · Loom · Loom

Giovannipajeu1 · Published 2024-01-27 · Updated 2024-10-18 · CVE-2024-23742

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Loom on macOS version 0.196.1 and before

Description An issue in Loom allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. The vendor disputes this issue because it requires local access to a victim's machine.

Recommendations For Loom on macOS version 0.196.1 and before, as a temporary workaround, consider disabling the RunAsNode and enableNodeClilnspectArguments settings until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-23742

Affected Products

Loom

References · 9

• 🔥 https://github.com/V3x0r/CVE-2024-23742 · Exploit
• https://osv.dev/vulnerability/CVE-2024-23742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23742 · Security Note
• https://t.me/cvenotify/71744 · Telegram Post
• https://t.me/cvenotify/98782 · Telegram Post
• https://t.me/cvenotify/69013 · Telegram Post
• https://electronjs.org/blog/statement-run-as-node-cves · Note
• https://twitter.com/CVEnew/status/1751438003027820609 · Twitter Post
• https://t.me/cvenotify/88380 · Telegram Post