Read the docs
TI-2024-15447 Aliases CVE-2024-23347GHSA-f63q-6c68-mrcx

Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined…

Priority LOW 36Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Fixed Meta Spark Studio (Meta Platforms, Inc): 176

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Meta PlatformsMeta Spark Studiobefore 176176Patch availableCNA
  • Meta Spark Studio VendorMeta Platforms Affected before 176 Fixed in 176 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:facebook:meta_spark_studio:*:*:*:*:*:*:*:*before 176VulnerableMeta
  • cpe:2.3:a:facebook:meta_spark_studio:*:*:*:*:*:*:*:* Versions before 176 Vulnerable ·Meta

Remediation

  • Fix · CNA Meta Spark Studio (Meta Platforms, Inc) Fixed in 176

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23347
  2. 2026-10-03 Alias added: GHSA-f63q-6c68-mrcx

References

Advisory 1

  • TI-2025-34672 An integer overflow vulnerability in the loading of ExecuTorch models can cause… CVSS 3.1CRITICAL 9.8
  • TI-2025-34671 Heap-based buffer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
  • TI-2025-34670 Out-of-bounds read in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
  • TI-2025-34669 Heap-based buffer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
  • TI-2025-21707 Integer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
  • TI-2025-21706 Integer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences