macOS TCC Bypass Vulnerabilities in GIMP, Cursor, MacVim (CVE-2025-8672, CVE-2025-8667)

Critical Vulnerability Information Vulnerability List CVE-2025-8672 - Release Date: September 11, 2025 - Affected Software: GIMP - Affected Versions: All 3.1.4.2 and higher - Vulnerability Type: Incorrect Default Permissions (CWE-276) CVE-2025-53811 - Release Date: September 26, 2025 - Affected Software: Mosh Pro - Affected Versions: All 1.3.2 and higher - Vulnerability Type: Incorrect Default Permissions (CWE-276) CVE-2025-9100 - Release Date: September 26, 2025 - Affected Software: Cursor - Affected Versions: All 15.4.1 and higher - Vulnerability Type: Incorrect Default Permissions (CWE-276) CVE-2025-8667 - Release Date: September 26, 2025 - Affected Software: MacVim - Affected Versions: All 101.2 and higher - Vulnerability Type: Exposure of Sensitive System Information to Unauthorized Control Domain (CWE-497) CVE-2025-8700 - Release Date: September 26, 2025 - Affected Software: Inverse Ninja - Affected Versions: All 5.0.175 and higher - Vulnerability Type: Exposure of Sensitive System Information to Unauthorized Control Domain (CWE-497) CVE-2025-53813 - Release Date: September 26, 2025 - Affected Software: Nozbe - Affected Versions: All 2025.11 and higher - Vulnerability Type: Incorrect Default Permissions (CWE-276) Vulnerability Description CERT Polska reported multiple vulnerabilities found in GIMP, Mosh Pro, Cursor, MacVim, Nozbe, and Inverse Ninja, all related to TCC (Transparency, Consent, and Control) bypass. CVE-2025-8672: A vulnerability in the Python interpreter within GIMP for macOS allows local users to execute arbitrary code through specific operations. CVE-2025-53811: A vulnerability in the feature of Mosh Pro allows local users to execute arbitrary code. CVE-2025-9100: A vulnerability in the feature of Cursor allows local users to execute arbitrary code. CVE-2025-8667: A vulnerability in the permission in MacVim allows local users to execute arbitrary code. CVE-2025-8700: A vulnerability in the permission in Inverse Ninja allows local users to execute arbitrary code. CVE-2025-53813: A vulnerability in the feature of Nozbe allows local users to execute arbitrary code. All these vulnerabilities enable local users to bypass TCC protection mechanisms and perform unauthorized operations.

Goal Reached Thanks to every supporter — we hit 100%!

macOS TCC Bypass Vulnerabilities in GIMP, Cursor, MacVim (CVE-2025-8672, CVE-2025-8667)