CVE-2023-40168

    Dashboard / Vulnerabilities / CVE-2023-40168

    CVE-2023-40168

    Published: 17 Aug 2023Last Modified: 12 Aug 2026

    Summary: Malicious projects can read and upload arbitrary files from disk in TurboWarp Desktop

    Details: TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a malicious project or custom extension to read arbitrary files from disk and upload them to a remote server. The only required user interaction is opening the sb3 file or loading the extension. The web version of TurboWarp is not affected. This bug has been addressed in commit `55e07e99b59` after an initial fix which was reverted. Users are advised to upgrade to version 1.8.0 or later. Users unable to upgrade should avoid opening sb3 files or loading extensions from untrusted sources.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40168.json, https://github.com/TurboWarp/desktop/security/advisories/GHSA-wg4p-vj7h-q82q, https://nvd.nist.gov/vuln/detail/CVE-2023-40168, https://github.com/TurboWarp/desktop/commit/55e07e99b59db334d75e8f46792a1569ab0884a6, https://github.com/TurboWarp/desktop/commit/a62dbd7a28b41857e3b6f32443fda0527d493267, https://github.com/TurboWarp/desktop/commit/f0f82aaf6cc8170e9da8b36953c98bfe533c019f

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -abe274e8ada50b65912bc9faddf0111cd74e837d

    Affected versions

    v1.8.0-beta.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-40168 | CVE-DB