CVE-2024-23755

HIGH 8.8CVE-2024-23755 · Published 23/03/2024 · updated 17/06/2026

In short

CVE-2024-23755 is a HIGH (CVSS 8.8) vulnerability affecting clickup (clickup).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 64.5% of all vulnerabilities.
Fix: update to 3.3.77 or later.

Package	Affected versions	Patched versions
clickup clickup	`< 3.3.77`	`3.3.77`

Description

ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode.

References

clickup.com/security/disclosures · Vendor Advisory
clickup.com/terms/security-policy · Not Applicable
electronjs.org/blog/statement-run-as-node-cves · Not Applicable
electronjs.org/docs/latest/tutorial/fuses · Not Applicable

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free