{"id":"CVE-2024-14010","state":"PUBLISHED","title":"Typora 1.7.4 OS Command Injection via Export PDF Preferences","description":"Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can inject malicious commands into the 'run command' input field during PDF export to achieve remote code execution.","publishedAt":"2025-12-12T19:55:03.584Z","updatedAt":"2026-09-30T17:20:01.608Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Typora Typora"],"affected":[{"vendor":"Typora","product":"Typora","defaultStatus":"unaffected","versions":[{"version":"1.7.4","status":"affected","versionType":"custom"}]}],"references":["https://www.exploit-db.com/exploits/51752","http://www.typora.io","https://www.vulncheck.com/advisories/typora-os-command-injection-via-export-pdf-preferences"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/14xxx/CVE-2024-14010.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-14010","state":"PUBLISHED","datePublished":"2025-12-12T19:55:03.584Z","dateUpdated":"2026-09-30T17:20:01.608Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-10-22T21:37:48.606Z"},"containers":{"cna":{"title":"Typora 1.7.4 OS Command Injection via Export PDF Preferences","descriptions":[{"lang":"en","value":"Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can inject malicious commands into the 'run command' input field during PDF export to achieve remote code execution."}],"affected":[{"vendor":"Typora","product":"Typora","defaultStatus":"unaffected","versions":[{"version":"1.7.4","status":"affected","versionType":"custom"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/51752","name":"ExploitDB-51752","tags":["exploit"]},{"url":"http://www.typora.io","name":"Typora Vendor Homepage","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/typora-os-command-injection-via-export-pdf-preferences","name":"VulnCheck Advisory: Typora 1.7.4 OS Command Injection via Export PDF Preferences","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-30T17:20:01.608Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:typora:typora:1.7.4:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","type":"finder","value":"Ahmet Ümit BAYRAM"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"vulncheck"},"datePublic":"2024-01-29T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-15T17:59:10.381657Z","id":"CVE-2024-14010","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-15T17:59:17.977Z"}}]}}}