CVE-2023-31874: Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').

PriorityP260high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EXPLOIT

EPSS

4.90%

91.0th percentile

Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_process').

Affected

1 ranges

Vendor	Product	Version range	Fixed in
yank-note	yank_note	—	—

Detection & IOCsextracted from sources · hover to see the quote

commandnodeRequire('child_process')↗

→Arbitrary code execution is triggered when a specially crafted Markdown (.md) file is opened in Yank Note v3.52.1 (Electron); the payload abuses the exposed `nodeRequire('child_process')` API available in the Electron renderer context. ↗
→Monitor for Yank Note (Electron) processes spawning unexpected child processes (e.g., calculator, shell) — a sign that a malicious .md file leveraged nodeRequire('child_process') to achieve code execution. ↗
→Inspect Markdown files opened in Yank Note for embedded JavaScript payloads referencing nodeRequire or child_process, which are the core primitives exploited in this CVE. ↗

·The vulnerability is specific to Yank Note version 3.52.1 running on Electron; the exploit was tested on Ubuntu 22.04 and macOS 13, so detection rules should account for both Linux and macOS process trees. ↗
·Exploitation requires the victim to open a crafted file; there is no remote/network vector — detections should focus on file-open events and subsequent anomalous child-process spawning from the Yank Note Electron process. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.