The vulnerability involves a world‑writable uninstall script (uninstall.sh) that is created with 777 permissions and located in a root‑owned path. When Arturia Software Center’s privileged helper executes this script during plugin uninstallation, an attacker who can modify the file gains the ability to run arbitrary commands as root. This constitutes a privilege escalation scenario, compromising system integrity and confidentiality, with the potential for full system compromise. The weakness is categorised under CWE‑276, File or Directory Permissions Weakness.

Arturia Software Center on macOS is affected. All installations that use the uninstall script are susceptible; no specific version ranges are provided, implying that the flaw is present across the current product stock.

The CVSS score of 8.2 indicates high severity, and although an EPSS score is missing, the lack of a known public exploit and absence from KEV suggest limited early exploitation but a potentially significant risk to any system where an attacker can obtain local write access. Exploitation requires local access to the file system to alter uninstall.sh; once modified, the privileged helper executes the script with root privileges, enabling any further malicious activity.