CVE-2024-23745

In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.

• CWE-77

• https://blog.xpnsec.com/dirtynib/
• https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model
• https://github.com/louiselalanne/CVE-2024-23745Exploit, Third Party Advisory
• https://blog.xpnsec.com/dirtynib/
• https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model
• https://github.com/louiselalanne/CVE-2024-23745Exploit, Third Party Advisory

Published

Jan 31, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2374The XML parsers within multiple WSO2 products accept user-su…9.1
• CVE-2024-23740An issue in Kap for macOS version 3.6.0 and before, allows r…9.8
• CVE-2024-23741An issue in Hyper on macOS version 3.4.1 and before, allows …9.8
• CVE-2024-23742An issue in Loom on macOS version 0.196.1 and before, allows…9.8
• CVE-2024-23743Notion through 3.1.0 on macOS might allow code execution bec…3.3
• CVE-2024-23744An issue was discovered in Mbed TLS 3.5.1. There is persiste…7.5
• CVE-2024-23746Miro Desktop 0.8.18 on macOS allows local Electron code inje…9.8
• CVE-2024-23747The Moderna Sistemas ModernaNet Hospital Management System 2…7.5
• CVE-2024-23749KiTTY versions 0.76.1.13 and before is vulnerable to command…7.8
• CVE-2024-2375The WPQA Builder WordPress plugin before 6.1.1 does not sani…5.4
• CVE-2024-23750MetaGPT through 0.6.4 allows the QaEngineer role to execute …8.8
• CVE-2024-23751LlamaIndex (aka llama_index) through 0.9.34 allows SQL injec…9.8