CVE-2024-25545

HIGH

Weave Desktop 7.78.10-7.84.1 - Local Code Execution via nwjs Framework Script Injection

Title source: llm
STIX 2.1

Description

An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component.

References (2)

Core 2

Scores

CVSS v3 7.8
EPSS 0.0019
EPSS Percentile 8.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-358
Status published
Products (1)
weave/weave_desktop 7.78.10 - 7.84.1
Published Apr 12, 2024
Tracked Since Feb 18, 2026