CVE-2023-50643 is a critical arbitrary code execution issue in Evernote for macOS 10.68.2, scored 9.8 by NVD. It involves the Electron RunAsNode and Node CLI inspect settings. Electron says it needs code already running on the machine, so update Evernote and review fuse settings if you ship Electron apps.
What's affected
The NVD record names Evernote for macOS version 10.68.2 and says a remote attacker can execute arbitrary code through the RunAsNode and enableNodeCliInspectArguments components. It was published on 2024-01-09 and carries no CWE.
NVD scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The Electron project takes a different view in its public statement on these CVEs. It says all released Electron versions enable both fuses by default, that abuse requires an attacker who can already run code on the victim's machine, and that the CVEs are not critical. Both points are useful: the 9.8 score is what you will see in scanners, and the vendor view is that the realistic risk is local.
The sources do not name a fixed Evernote version. The Electron statement says the remedy is for application authors to disable the runAsNode fuse. Check Evernote's release notes for a build that does so.
How to check if you're exposed
On a Mac, open Evernote, choose About Evernote from the app menu and read the version. Version 10.68.2 is the one named in the record.
If you build Electron apps, check whether your packaged application has the runAsNode fuse enabled. Electron's fuses documentation explains how to read and flip fuse settings, and the same check applies to every Electron app you distribute, not only this one.
Inventory matters here. Electron apps bundle their own runtime, so a system wide patch of Node does not help. Each application has to be updated by its vendor.
What to do now
- Update Evernote for macOS to the latest version available and confirm it is newer than 10.68.2.
- If you ship an Electron app, disable the runAsNode fuse and test any feature that depends on forking Node processes.
- Electron notes that process.fork in the main process stops working with this fuse off, so move such work to Utility Processes.
- Review the Electron Security Checklist for other settings.
- Keep an inventory of desktop apps that bundle Electron so you can find the next one quickly.
Why it matters
There is no CWE assigned in the record. The class of issue is a legitimate application binary that can be turned into a general purpose Node.js interpreter through an environment variable or a command line option. Attackers who already have a foothold can use a signed, trusted app as a stand in for their own tooling, which can blur detection.
That is why the severity debate matters. A flaw that needs prior code execution does not give an attacker their first way in, but it can help them hide and move. Reasonable teams will patch it as hardening rather than as an emergency.
The record shows no CISA Known Exploited Vulnerabilities listing, and neither fetched source reports exploitation in the wild.
Quick check
Is the 9.8 score the whole story?
No. NVD scores it as remote with no privileges. Electron states abuse needs an attacker who can already run code on the machine and rates the CVEs as not critical.
Who needs to act besides Evernote users?
Anyone shipping an Electron application, since both fuses are on by default and should be reviewed.
Sources
Last reviewed: 19 October 2026.
