CVE-2024-42366

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In addition to the patch, VRCX maintainers worked with the VRC team and blocked the older version of VRCX on the VRC's API side. Users who use the older version of VRCX must update their installation to continue using VRCX.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Aug 8, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-423674.8aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, statCVE-2024-423686.5OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exCVE-2024-423695.3matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure sucCVE-2024-42378.8A vulnerability, which was classified as critical, was found in Tenda AX1806 1.0.0.1. Affected is the function R7WebsSecurityHandler of the CVE-2024-423708.3Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow CVE-2024-423715.4The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utiCVE-2024-423726.5Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restrCVE-2024-423735.4SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escaCVE-2024-423748.2BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can reCVE-2024-423754.3SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that coulCVE-2024-423766.5SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privilegesCVE-2024-423774.3SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to ins
CVE-2024-42366: Critical severity, CVSS 9.0 | Vulnix