CVE-2024-23755: ClickUp Desktop RCE Vulnerability

CVE-2024-23755 Overview

CVE-2024-23755 affects ClickUp Desktop before version 3.3.77 on macOS and Windows. The application ships with insecure Electron Fuse configurations, leaving the RunAsNode fuse enabled. Attackers with local access can leverage the signed ClickUp binary to execute arbitrary Node.js code inside a trusted process. This bypasses application allowlisting and code-signing controls that rely on the ClickUp executable's identity. The flaw is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Attackers can inject and execute arbitrary code through the ClickUp Electron runtime, gaining full user-level code execution under the identity of a signed application.

Affected Products

ClickUp Desktop versions prior to 3.3.77
Apple macOS installations of ClickUp Desktop
Microsoft Windows installations of ClickUp Desktop

Discovery Timeline

2024-03-23 - CVE-2024-23755 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-23755

Vulnerability Analysis

ClickUp Desktop is built on the Electron framework, which bundles Chromium and Node.js into a single desktop runtime. Electron exposes several build-time toggles known as Fuses that harden the runtime against abuse. The RunAsNode fuse controls whether the packaged application binary honors the ELECTRON_RUN_AS_NODE environment variable. When this variable is set and the fuse is enabled, the application launches as a general-purpose Node.js interpreter instead of the ClickUp UI.

ClickUp shipped builds before 3.3.77 with RunAsNode left enabled. An attacker with local execution rights can invoke the ClickUp binary with ELECTRON_RUN_AS_NODE=1 and pass an arbitrary JavaScript payload. The payload executes with the privileges and code-signing identity of ClickUp, evading controls that trust the vendor signature.

Root Cause

The root cause is an insecure default in the Electron Fuse configuration. RunAsNode, EnableNodeCliInspectArguments, and related fuses were not flipped off during the build pipeline. See the Electron Fuses tutorial and the Electron statement on RunAsNode CVEs for the framework guidance ClickUp had not applied.

Attack Vector

Exploitation requires the ability to launch the ClickUp binary with a controlled environment. A local attacker, malicious script, or lower-privileged process on the same host can set ELECTRON_RUN_AS_NODE and pass a -e inline script or a .js file path. The resulting process runs as Node.js under the ClickUp signature, permitting arbitrary code execution, credential access, and persistence under a trusted binary identity.

No verified public proof-of-concept code is available. Refer to the ClickUp Security Disclosures page for vendor-provided technical details.

Detection Methods for CVE-2024-23755

Indicators of Compromise

Process creation events showing the ClickUp executable launched with the ELECTRON_RUN_AS_NODE environment variable set to 1.
ClickUp processes spawning cmd.exe, powershell.exe, bash, osascript, or other interpreters outside normal application behavior.
Unexpected outbound network connections initiated by the ClickUp binary to non-ClickUp infrastructure.

Detection Strategies

Hunt for command lines that combine the ClickUp binary path with Node.js flags such as -e, --inspect, --inspect-brk, or a .js file argument.
Correlate ClickUp process ancestry with child processes that touch credential stores, browser profiles, or SSH keys.
Inventory installed ClickUp Desktop versions across managed endpoints and flag any build older than 3.3.77.

Monitoring Recommendations

Enable environment variable capture in endpoint telemetry so ELECTRON_RUN_AS_NODE invocations become visible to detection engineering.
Baseline normal ClickUp child-process behavior and alert on deviations, particularly script interpreter launches.
Monitor for local privilege escalation attempts that stage payloads next to signed Electron applications.

How to Mitigate CVE-2024-23755

Immediate Actions Required

Upgrade all ClickUp Desktop installations to version 3.3.77 or later on both macOS and Windows.
Audit endpoints for vulnerable ClickUp builds and remove or block any legacy installers cached in software distribution shares.
Restrict which users can set process environment variables on shared or high-value hosts.

Patch Information

ClickUp resolved the issue in Desktop 3.3.77 by flipping the vulnerable Electron Fuses, including RunAsNode. Consult the ClickUp Security Disclosures and ClickUp Security Policy for the vendor advisory and remediation guidance. No public exploit is currently listed in Exploit-DB, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog.

Workarounds

Block execution of ClickUp Desktop versions below 3.3.77 through application control policies such as Windows Defender Application Control or macOS binary allowlisting.
Strip or deny the ELECTRON_RUN_AS_NODE environment variable in managed shell profiles and endpoint configuration baselines.
Remove ClickUp Desktop from high-sensitivity systems until patching is confirmed and rely on the ClickUp web client in the interim.

bash

# Example: verify installed ClickUp version on macOS
/usr/bin/mdls -name kMDItemVersion "/Applications/ClickUp.app"

# Example: enumerate ClickUp process launches with RunAsNode on Windows (PowerShell)
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4688]]" |
  Where-Object { $_.Message -match 'ClickUp' -and $_.Message -match 'ELECTRON_RUN_AS_NODE' }