Skip to content
OpenAdvisories
High · 7.8 CVE-2024-23347 EUVD-2024-20852GHSA-f63q-6c68-mrcx

Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of…

Published Jan 16, 2024 · Updated Jun 20, 2025 · Assigned by facebook

Description

Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application.

Affected products

VendorProductAffectedFixed
Meta Platforms Meta Spark Studio < 176 176

References