Cyber Resilience

CVE-2024-14010

HighPublic PoC

Published: 12 December 2025

Published
12 December 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v4 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0032 55.8th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-14010 is a high-severity OS Command Injection (CWE-78) vulnerability in Typora (inferred from references). Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 44.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-14010 is a command injection vulnerability (CWE-78) in Typora version 1.7.4. The issue affects the PDF export preferences, where the 'run command' input field fails to properly sanitize user input, enabling attackers to inject and execute arbitrary system commands.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely with low complexity, no privileges, and no user interaction required. Attackers can achieve remote code execution by injecting malicious commands into the vulnerable field during PDF export operations.

Advisories and related resources include the Typora official site at http://www.typora.io, a proof-of-concept exploit at https://www.exploit-db.com/exploits/51752, and a detailed advisory from Vulncheck at https://www.vulncheck.com/advisories/typora-os-command-injection-via-export-pdf-preferences.

EU & UK References

Vulnerability details

Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can inject malicious commands into the 'run command' input field during PDF export to achieve remote code execution.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
Why these techniques?

Command injection vulnerability in Typora enables remote code execution by exploiting a client application (T1203) and facilitates arbitrary command execution via system interpreters (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-26331Shared CWE-78
CVE-2025-65480Shared CWE-78
CVE-2026-4946Shared CWE-78
CVE-2026-40517Shared CWE-78
CVE-2026-26029Shared CWE-78
CVE-2025-52626Shared CWE-78
CVE-2025-6514Shared CWE-78
CVE-2026-25546Shared CWE-78
CVE-2025-54074Shared CWE-78
CVE-2025-60962Shared CWE-78

Affected Assets

Typora
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of user inputs to the 'run command' field in Typora's PDF export preferences to block command injection.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, prioritization, and remediation of the specific command injection flaw in Typora 1.7.4 via patching.

CM-11 User-installed Software good match
prevent

Restricts or prohibits user installation of vulnerable Typora software on organizational systems, eliminating exposure to the CVE.

References