CVE-2024-23755

ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://clickup.com/security/disclosures	Vendor Advisory
https://clickup.com/terms/security-policy	Not Applicable
https://www.electronjs.org/blog/statement-run-as-node-cves	Not Applicable
https://www.electronjs.org/docs/latest/tutorial/fuses	Not Applicable
https://clickup.com/security/disclosures	Vendor Advisory
https://clickup.com/terms/security-policy	Not Applicable
https://www.electronjs.org/blog/statement-run-as-node-cves	Not Applicable
https://www.electronjs.org/docs/latest/tutorial/fuses	Not Applicable

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:clickup:clickup:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

18 Sep 2025, 16:41

Type	Values Removed	Values Added
First Time		Apple Microsoft Clickup clickup Microsoft windows Apple macos Clickup
References	~~() https://clickup.com/security/disclosures -~~	() https://clickup.com/security/disclosures - Vendor Advisory
References	~~() https://clickup.com/terms/security-policy -~~	() https://clickup.com/terms/security-policy - Not Applicable
References	~~() https://www.electronjs.org/blog/statement-run-as-node-cves -~~	() https://www.electronjs.org/blog/statement-run-as-node-cves - Not Applicable
References	~~() https://www.electronjs.org/docs/latest/tutorial/fuses -~~	() https://www.electronjs.org/docs/latest/tutorial/fuses - Not Applicable
CPE		cpe:2.3:a:clickup:clickup:::::::: cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*

Information

Published : 2024-03-23 22:15

Updated : 2025-09-18 16:41

NVD link : CVE-2024-23755

Mitre link : CVE-2024-23755

CVE.ORG link : CVE-2024-23755

JSON object : View

Products Affected

apple

macos

clickup

clickup

microsoft

windows

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2024-23755", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-03-23T22:15:07.827", "references": [{"url": "https://clickup.com/security/disclosures", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://clickup.com/terms/security-policy", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://www.electronjs.org/blog/statement-run-as-node-cves", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://www.electronjs.org/docs/latest/tutorial/fuses", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://clickup.com/security/disclosures", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://clickup.com/terms/security-policy", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.electronjs.org/blog/statement-run-as-node-cves", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.electronjs.org/docs/latest/tutorial/fuses", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode."}, {"lang": "es", "value": "ClickUp Desktop anterior a 3.3.77 en macOS y Windows permite la inyecci\u00f3n de c\u00f3digo debido a Electron Fuses espec\u00edficos. Existe una protecci\u00f3n inadecuada contra la inyecci\u00f3n de c\u00f3digo a trav\u00e9s de configuraciones como RunAsNode."}], "lastModified": "2025-09-18T16:41:21.520", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:clickup:clickup:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59915287-3B54-4AFB-A0EB-742737CB7B36", "versionEndExcluding": "3.3.77"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}