Clash vulnerabilities

2 known vulnerabilities in Clash from Clash Project. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Clash: Incorrect Permission Assignment for Critical Resource

  CVE-2023-24205Feb 23, 2023Clash ProjectEPSS 1.29%

  Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw-setting.yaml).

• 7.8 High severity

  Clash: Files or Directories Accessible to External Parties

  CVE-2022-40126Sep 29, 2022Clash Project

  A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated.