CVE-2023-44402

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron.

• CWE-345

• https://github.com/electron/electron/pull/39788Issue Tracking
• https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85Vendor Advisory
• https://www.electronjs.org/docs/latest/tutorial/fusesProduct
• https://github.com/electron/electron/pull/39788Issue Tracking
• https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85Vendor Advisory
• https://www.electronjs.org/docs/latest/tutorial/fusesProduct

Published

Dec 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-44397CloudExplorer Lite is an open source, lightweight cloud mana…9.8
• CVE-2023-44398Exiv2 is a C++ library and a command-line utility to read, w…8.8
• CVE-2023-44399ZITADEL provides identity infrastructure. In versions 2.37.2…5.3
• CVE-2023-4440A vulnerability was found in SourceCodester Free Hospital Ma…9.8
• CVE-2023-44400Uptime Kuma is a self-hosted monitoring tool. Prior to versi…7.8
• CVE-2023-44401The Silverstripe CMS GraphQL Server serves Silverstripe data…5.3
• CVE-2023-44403D-Link DAP-1325 HNAP SetWLanRadioSettings Channel Command In…8.8
• CVE-2023-44404D-Link DAP-1325 get_value_from_app Stack-based Buffer Overfl…8.8
• CVE-2023-44405D-Link DAP-1325 get_value_of_key Stack-based Buffer Overflow…8.8
• CVE-2023-44406D-Link DAP-1325 SetAPLanSettings DeviceName Stack-based Buff…8.8
• CVE-2023-44407D-Link DAP-1325 SetAPLanSettings Gateway Stack-based Buffer …8.8
• CVE-2023-44408D-Link DAP-1325 SetAPLanSettings IPAddr Stack-based Buffer O…8.8