Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-40168— Malicious projects can read and upload arbitrary files from disk in TurboWarp Desktop

Quick assessment

Affected
TurboWarp desktop
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

TurboWarp是TurboWarp开源的一款应用程序。 TurboWarp 1.8.0之前版本存在安全漏洞，该漏洞源于允许恶意项目或自定义扩展从磁盘读取任意文件并将其上传到远程服务器。

CVSS 7.4 · High EPSS 0.69% · P51

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-40168

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Malicious projects can read and upload arbitrary files from disk in TurboWarp Desktop
Source: CVE Program / CVE List V5
Vulnerability Description
TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a malicious project or custom extension to read arbitrary files from disk and upload them to a remote server. The only required user interaction is opening the sb3 file or loading the extension. The web version of TurboWarp is not affected. This bug has been addressed in commit `55e07e99b59` after an initial fix which was reverted. Users are advised to upgrade to version 1.8.0 or later. Users unable to upgrade should avoid opening sb3 files or loading extensions from untrusted sources.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
TurboWarp 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TurboWarp是TurboWarp开源的一款应用程序。 TurboWarp 1.8.0之前版本存在安全漏洞，该漏洞源于允许恶意项目或自定义扩展从磁盘读取任意文件并将其上传到远程服务器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
TurboWarp desktop < 1.8.0 -

II. Public POCs for CVE-2023-40168

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 7430 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2023-40168

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-40168 (3)

Vendor Advisories for CVE-2023-40168 (1)

IV. Related Vulnerabilities

Same product: desktop
Same weakness: CWE-863

V. Comments for CVE-2023-40168

No comments yet

Leave a comment