Patch & vulnerability status
ActivityWatch 0.13.2
Latest tracked version 0.13.2. Release status, tracked CVEs, and automated cross-platform patching for ActivityWatch.
| Platform | Latest version | CVEs tracked | Last checked |
|---|---|---|---|
| Windows | 0.13.2 | 2 | 2024-12-06 |
Known vulnerabilities (CVEs) in ActivityWatch
Lavawall tracks 2 published CVEs affecting ActivityWatch, and deploys the versions that fix them automatically across your fleet.
| CVE | Published | Severity | Details | Vector |
|---|---|---|---|---|
| CVE-2022-31149 | 2022-09-07 14:15:09 | HIGH (9) | ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone running ActivityWatch and gives the attacker full access to the ActivityWatch REST API. Users should upgrade to v0.12.0b2 or later to receive a patch. As a workaround, block DNS lookups that resolve to 127.0.0.1. | NETWORK |
| CVE-2021-32692 | 2022-12-23 03:15:08 | CRITICAL (10) | Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on any macOS machine with ActivityWatch running. The attacker can exploit this vulnerability by having the user visiting a website with the page title set to a malicious string. An attacker could use another application to accomplish the same, but the web browser is the most likely attack vector. This issue is patched in version 0.11.0. As a workaround, users can run the latest version of aw-watcher-window from source, or manually patch the `printAppTitle.scpt` file. | NETWORK |
Why keeping ActivityWatch patched matters
Unpatched third-party applications are one of the most common ways attackers get in: 57% of breached MSP clients and 32% of ransomware cases trace back to a missing patch. Every ActivityWatch release that fixes a security bug is public, so attackers see it too, and an out-of-date install becomes a documented way in. Tracking the installed version on every machine and closing the gap quickly is what turns a disclosed CVE into a non-event.
How Lavawall® patches ActivityWatch
Lavawall® watches ActivityWatch releases and CVEs continuously, ranks each update by risk, and deploys it across your whole fleet, Windows, macOS, and Linux, from a single agent, independently of your RMM. You get one place to see which machines are behind on ActivityWatch, one policy to bring them current, and timestamped evidence for audits.
Frequently asked questions
Lavawall tracks ActivityWatch at version 0.13.2 (last checked 2024-12-06). New releases are monitored continuously and can be deployed automatically across your fleet.
Lavawall tracks 2 CVEs for ActivityWatch and remediates them automatically as part of patching.
Deploy the Lavawall® agent and ActivityWatch updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Lavawall® monitors releases and CVEs for ActivityWatch through public information and proprietary statistical analysis, and can patch it automatically across your fleet.