CVE-2023-49314

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.

• CWE-94

• https://asana.com/pt/downloadProduct
• https://github.com/electron/fusesProduct
• https://github.com/louiselalanne/CVE-2023-49314Third Party Advisory
• https://github.com/r3ggi/electroniz3rProduct
• https://www.electronjs.org/blog/statement-run-as-node-cves
• https://www.electronjs.org/docs/latest/tutorial/fusesTechnical Description
• https://asana.com/pt/downloadProduct
• https://github.com/electron/fusesProduct
• https://github.com/louiselalanne/CVE-2023-49314Third Party Advisory
• https://github.com/r3ggi/electroniz3rProduct
• https://www.electronjs.org/blog/statement-run-as-node-cves
• https://www.electronjs.org/docs/latest/tutorial/fusesTechnical Description

Published

Nov 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49298OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain s…7.5
• CVE-2023-49299Improper Input Validation vulnerability in Apache DolphinSch…8.8
• CVE-2023-4930The Front End PM WordPress plugin before 11.4.3 does not blo…6.5
• CVE-2023-4931Uncontrolled search path element vulnerability in Plesk Inst…7.8
• CVE-2023-49312Precision Bridge PrecisionBridge.exe (aka the thick client) …9.1
• CVE-2023-49313A dylib injection vulnerability in XMachOViewer 0.04 allows …9.8
• CVE-2023-49316In Math/BinaryField.php in phpseclib 3 before 3.0.34, excess…7.5
• CVE-2023-4932SAS application is vulnerable to Reflected Cross-Site Script…5.4
• CVE-2023-49321Certain WithSecure products allow a Denial of Service becaus…5.3
• CVE-2023-49322Certain WithSecure products allow a Denial of Service becaus…7.5
• CVE-2023-49328On a Wolters Kluwer B.POINT 23.70.00 server running Linux on…7.2
• CVE-2023-49329Anomali Match before 4.6.2 allows OS Command Injection. An a…7.2