CVE-2023-7245: connect Code Injection (CVSS 7.8)

Description

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable

Is your site exposed to CVE-2023-7245?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-95 CWE-95

Affected Products

Vendor	Product	Versions
openvpn	connect	3.2.0 — 3.4.4
openvpn	connect	3.2.0 — 3.4.8
openvpn	connect	All
openvpn	connect	All
openvpn	connect	All
openvpn	connect	All
openvpn	connect	All
openvpn	connect	All
openvpn	connect	All
openvpn	connect	All
openvpn	connect	All
openvpn	connect	All

References

Other References

https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/ https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/ https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/ https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/

Frequently Asked Questions

What is CVE-2023-7245? +

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2023-7245? +

CVE-2023-7245 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2023-7245? +

CVE-2023-7245 affects products from openvpn, specifically: connect. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-7245? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-12140

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the …

CVE-2026-8914

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to …

CVE-2025-49598

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is …

CVE-2025-58365

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, …

CVE-2026-53875

picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers …

CVE-2026-44128

SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI because an endpoint …

CVE-2023-7245