CVE-2021-40531

 

Published at: - 06-09-2021 11:15

Last modified: - 25-04-2022 07:44

Total changes: - 10

Description

Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://www.sketch.com/updates/#version-75
• https://jonpalmisc.com/2021/11/22/cve-2021-40531

 

Keywords

NVD

 

CVE-2021-40531

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures