PT-2024-6951 · Arc · Arc

Eva

·

Published

2024-08-25

·

Updated

2025-09-10

·

CVE-2024-45489

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Arc versions prior to 2024-08-26
Description The issue is related to a remote code execution vulnerability in JavaScript boosts. Normally, boosts running JavaScript cannot be shared by default; however, due to misconfigured Firebase ACLs, it is possible to create or update a boost using another user's ID. This installs the boost in the victim's browser and runs arbitrary JavaScript on that browser in a privileged context. There are no reported affected users.
Recommendations For Arc versions prior to 2024-08-26, update to a version released after 2024-08-26 to resolve the issue. As a temporary workaround, consider restricting access to JavaScript boosts to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-08200
CVE-2024-45489

Affected Products

Arc