CleanShot X for macOS contains an insecure deserialization flaw that allows an attacker to embed malicious objects inside a .cleanshot project file. When a user opens such a file, the application automatically parses the data and executes the payload in the context of the current user, resulting in arbitrary code execution. The weakness is a classic insecure deserialization flaw (CWE‑502).

The vulnerability affects CleanShot X for macOS. Versions earlier than 4.5.2, 4.6.3, 4.7.8, and 4.8.10 are impacted. Users running these earlier releases are at risk if they open files from untrusted sources.

The CVSS score of 8.4 indicates a high severity. The EPSS score is not available, so an exact likelihood cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to craft a malicious .cleanshot file and trick a victim into opening it, so the vector is user‑initiated file opening. Once the file is opened, the payload executes automatically, giving the attacker full control of the victim’s user session.