CVE-2024-14010

CriticalPublic PoCRCE

Published: 12 December 2025

Published

12 December 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0029 52.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-14010 is a critical-severity OS Command Injection (CWE-78) vulnerability in Typora (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 47.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly requires validation and sanitization of user inputs to the 'run command' field in Typora's PDF export preferences to block command injection.

SI-2 Flaw Remediation good match

prevent

Mandates timely identification, prioritization, and remediation of the specific command injection flaw in Typora 1.7.4 via patching.

CM-11 User-installed Software good match

prevent

Restricts or prohibits user installation of vulnerable Typora software on organizational systems, eliminating exposure to the CVE.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Command injection vulnerability in Typora enables remote code execution by exploiting a client application (T1203) and facilitates arbitrary command execution via system interpreters (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can inject malicious commands into the 'run command' input field during PDF export to achieve remote code execution.

Deeper analysisAI

CVE-2024-14010 is a command injection vulnerability (CWE-78) in Typora version 1.7.4. The issue affects the PDF export preferences, where the 'run command' input field fails to properly sanitize user input, enabling attackers to inject and execute arbitrary system commands.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely with low complexity, no privileges, and no user interaction required. Attackers can achieve remote code execution by injecting malicious commands into the vulnerable field during PDF export operations.

Advisories and related resources include the Typora official site at http://www.typora.io, a proof-of-concept exploit at https://www.exploit-db.com/exploits/51752, and a detailed advisory from Vulncheck at https://www.vulncheck.com/advisories/typora-os-command-injection-via-export-pdf-preferences.