CVE-2024-23743: Low severity Notion Notion vulnerability
Notion through 3.1.0 on macOS might allow code execution because of RunAsNode and enableNodeClilnspectArguments. NOTE: the vendor states "the attacker must launch the Notion Desktop application with nonstandard flags that turn the Electron-based application into a Node.js execution environment."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Notion Desktop (macOS)to a version that resolves this vulnerability.Fixed in 3.1.0 - Configuration
Disable or remove Electron features that allow running the application as a Node.js environment (the issue is described as occurring through RunAsNode and enableNodeClilnspectArguments when launched with nonstandard flags).
Notion Desktop (Electron) RunAsNode = disable - Configuration
Disable or remove support for enableNodeClilnspectArguments so launching with nonstandard flags cannot turn the Electron app into a Node.js execution environment.
Notion Desktop (Electron) enableNodeClilnspectArguments = disable
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23743?
CVE-2024-23743 has been classified as a security vulnerability that allows code execution through manipulative application launching.
How do I fix CVE-2024-23743?
To mitigate CVE-2024-23743, ensure that Notion is updated to a version later than 3.1.0 to eliminate exposure to the vulnerability.
Who is affected by CVE-2024-23743?
Users of Notion on macOS versions up to 3.1.0 are affected by CVE-2024-23743.
What allows the exploitation of CVE-2024-23743?
CVE-2024-23743 can be exploited by launching the Notion Desktop application with nonstandard flags turning it into a Node.js environment.
Is there a proof of concept for CVE-2024-23743?
Yes, reports indicate that there are proof of concept exploits available for CVE-2024-23743 demonstrating its potential impact.