Clash Project vulnerabilities
We track 2 vulnerabilities in Clash Project products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on February 23, 2023.
2vulnerabilities
1critical
1high
0exploited
8.8average CVSS score
Latest Clash Project vulnerabilities
- 9.8 Critical severity
Clash: Incorrect Permission Assignment for Critical Resource
Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw-setting.yaml).
- 7.8 High severity
Clash: Files or Directories Accessible to External Parties
A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated.