Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2021-09-06T20:17:01
Updated: 2024-08-04T02:44:10.783Z
Reserved: 2021-09-06T00:00:00
Link: CVE-2021-40531
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2021-09-06T21:15:07.370
Modified: 2022-04-25T17:44:38.600
Link: CVE-2021-40531
Redhat
No data.