{"id":"CVE-2024-23745","aliases":["EUVD-2024-21201","GHSA-27hv-w8j5-r6ww"],"status":"disputed","title":"In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can...","description":"In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01984,"percentile":0.80726,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2024-01-31T00:00:00Z","modified":"2026-06-17T07:13:30Z","exploits":[{"source":"pocgithub","id":"louiselalanne/CVE-2024-23745","title":"louiselalanne/CVE-2024-23745","date":"2024-01-25","url":"https://github.com/louiselalanne/CVE-2024-23745"}],"products":[{"vendor":"notion","product":"web_clipper"}],"references":[{"url":"https://github.com/louiselalanne/CVE-2024-23745","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://blog.xpnsec.com/dirtynib/","tags":["x_transferred"]},{"url":"https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23745"},{"url":"https://blog.xpnsec.com/dirtynib"},{"url":"https://github.com/advisories/GHSA-27hv-w8j5-r6ww"}],"sources":{"cve":[{"id":"CVE-2024-23745","description":"In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.","status":"disputed","published":"2024-01-31T00:00:00Z","modified":"2024-11-12T20:37:48.854Z","updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-21201","description":"In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.","status":"published","published":"2024-01-31T00:00:00Z","modified":"2024-11-12T20:37:48Z","updated_at":"2026-11-03T00:05:03.478844Z"}],"ghsa":[{"id":"GHSA-27hv-w8j5-r6ww","title":"In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can...","description":"In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context.","status":"published","published":"2024-01-31T03:30:30Z","modified":"2026-03-24T05:08:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:06:49.419052Z"}],"nvd":[{"id":"CVE-2024-23745","description":"In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.","status":"disputed","published":"2024-01-31T02:15:54.52Z","modified":"2026-06-17T07:13:30.68Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:34.891666Z"}]}}