The vulnerability lies in the DirectorServer WebSocket that accepts connections from any origin without checking the HTTP Origin header during the handshake. A page loaded in the same browser session can silently connect to the local WebSocket server and send arbitrary DirectorCommand messages, giving the attacker full control over the teleprompter’s content. This flaw is a classic example of Cross‑Site WebSocket Hijacking and enables remote manipulation of the application from a web page.

Textream, the free macOS teleprompter application, is affected on all versions earlier than 1.5.1. Users of these versions run an unpatched local WebSocket server that trusts all origins.

The CVSS score of 7.6 categorises the flaw as high severity, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalogue. The most likely attack vector is a malicious web page that the target user visits while the same browser instance is running Textream; the attacker then establishes a WebSocket connection controlled by the page. The flaw does not require privilege escalation beyond what the user already has on the system.