CVE-2024-14010

CriticalCVSS 9.8/10Last modified Sep 30, 2026

Description

Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can inject malicious commands into the 'run command' input field during PDF export to achieve remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Dec 12, 2025
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-140127.3Potential privilege escalation issue in Revenera InstallShield version 2023 R1 running a renamed Setup.exe on Windows. When a local administCVE-2024-140157.1The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the pagCVE-2024-14024.3Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to beCVE-2024-140205.0A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the CVE-2024-140217.8LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_frCVE-2024-140246.7An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who haCVE-2024-140256.7An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an CVE-2024-140267.8A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network accCVE-2024-140275.5In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernCVE-2024-140286.5Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS. This issue affects: smartLink HW-DP: tCVE-2024-140297.5Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunkCVE-2024-14039.8In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an
CVE-2024-14010: Critical severity, CVSS 9.8 | Vulnix