CVE-2024-14010

EUVD-2024-55353
Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can inject malicious commands into the 'run command' input field during PDF export to achieve remote code execution.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 65.87%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
typoratypora
1.7.4
CNA
Common Weakness Enumeration
References
http://www.typora.io
https://www.exploit-db.com/exploits/51752
https://www.vulncheck.com/advisories/typora-os-command-injection-via-export-pdf-preferences