Poedit CVE-2025-4280 & Viscosity CVE-2025-4412 macOS TCC Privilege Escalation via Python Interpreter

Critical Vulnerability Information Poedit (CVE-2025-4280) CVE ID: CVE-2025-4280 Release Date: May 22, 2025 Vendor: Poedit Product: Poedit Affected Versions: From 2.0 to 3.6.3 Vulnerability Type (CWE): Incorrect Default Permissions (CWE-276) Report Source: Reported to CERT Polska Description: The macOS version of Poedit bundles a Python interpreter that inherits Transparency, Consent, and Control (TCC) permissions granted to the main application bundle by the user. An attacker with local user access can invoke this interpreter to execute arbitrary commands or scripts, leveraging the TCC permissions previously granted to the application to access privacy-protected files within the user’s folder without triggering any user prompt. Accessing resources beyond the previously granted TCC permissions will prompt the user to approve the request under Poedit’s name, potentially masking the attacker’s malicious intent. Fixed Version: 3.6.3 Viscosity (CVE-2025-4412) CVE ID: CVE-2025-4412 Release Date: May 26, 2025 Vendor: SparkLabs Product: Viscosity Affected Versions: All up to 1.11.4 Vulnerability Type (CWE): Incorrect Default Permissions (CWE-276) Report Source: Reported to CERT Polska Description: On macOS systems, it is possible to load dynamic libraries using Viscosity’s TCC (Transparency, Consent, and Control) identity by exploiting a launch agent and loading the openvpn process from the application bundle. The obtained resource access permissions are limited to resources not requiring authorization, such as camera or microphone access. Only file resource permissions explicitly granted by the user are applicable. Accessing other resources beyond the granted permissions requires user interaction with system prompts to request additional permissions. Fixed Version: 1.11.5 Acknowledgments Thank you to Karol Mazurek from Aline Team for the vulnerability report.

Goal Reached Thanks to every supporter — we hit 100%!

Poedit CVE-2025-4280 & Viscosity CVE-2025-4412 macOS TCC Privilege Escalation via Python Interpreter