CVE-2023-49314

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://asana.com/pt/downloadProduct
https://github.com/electron/fusesProduct
https://github.com/louiselalanne/CVE-2023-49314Third Party Advisory
https://github.com/r3ggi/electroniz3rProduct
https://www.electronjs.org/blog/statement-run-as-node-cves
https://www.electronjs.org/docs/latest/tutorial/fusesTechnical Description
https://asana.com/pt/downloadProduct
https://github.com/electron/fusesProduct
https://github.com/louiselalanne/CVE-2023-49314Third Party Advisory
https://github.com/r3ggi/electroniz3rProduct
https://www.electronjs.org/blog/statement-run-as-node-cves
https://www.electronjs.org/docs/latest/tutorial/fusesTechnical Description

Timeline

Published: Nov 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-493167.5In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees can lead to a denial of service.CVE-2023-49325.4SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SA CVE-2023-493215.3Certain WithSecure products allow a Denial of Service because scanning a crafted file takes a long time, and causes the scanner to hang. Thi CVE-2023-493227.5Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanning engine crash. Thi CVE-2023-493287.2On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve CVE-2023-493297.2Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This a CVE-2023-49335.3The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job CVE-2023-493308.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data.CVE-2023-493318.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option.CVE-2023-493328.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.CVE-2023-493338.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.CVE-2023-493348.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.