CVE-2024-14010 is an OS command injection vulnerability in Typora 1.7.4 affecting the PDF export preferences feature. Attackers can supply malicious input to the 'run command' field, which is improperly sanitized, leading to arbitrary command execution on the host system. The vulnerability has a CVSS 4.0 base score of 8.5, indicating high severity, with local attack vector and low complexity. The vulnerability does not affect cloud services and no vendor patch or advisory has been published yet.

Successful exploitation allows an attacker with local access and low privileges to execute arbitrary system commands, potentially leading to full system compromise depending on the environment. This can result in unauthorized code execution and control over the affected system. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the vulnerable PDF export 'run command' feature or restrict access to Typora 1.7.4 installations. Monitor for vendor updates and apply patches promptly once released.