CVE-2025-53811

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-53811", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2025-07-09T13:42:44.065Z", "datePublished": "2025-08-26T12:22:55.182Z", "dateUpdated": "2026-08-31T13:46:44.906Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-31T13:46:44.906Z"}, "title": "TCC Bypass via misconfigured Node fuses in Mosh-Pro", "datePublic": "2025-08-26T12:19:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "Mosh-Pro", "product": "Mosh-Pro", "platforms": ["MacOS"], "versions": [{"status": "affected", "version": "0.0.0", "lessThanOrEqual": "1.3.6", "versionType": "semver"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mosh-pro:mosh-pro:*:*:macos:*:*:*:*:*", "versionStartIncluding": "0.0.0", "versionEndIncluding": "1.3.6"}]}]}], "descriptions": [{"lang": "en", "value": "The configuration of Mosh-Pro on macOS, specifically the \"RunAsNode\" fuse enabled, allows a\u00a0local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions.\u00a0\nAcquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Mosh-Pro, potentially disguising attacker's malicious intent.\u00a0\n\nThis issue was fixed in 1.3.7 version of Mosh-Pro.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The configuration of Mosh-Pro on macOS, specifically the \"RunAsNode\" fuse enabled, allows a&nbsp;local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions.&nbsp;<br>Acquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Mosh-Pro, potentially disguising attacker's malicious intent.&nbsp;<br><br>This issue was fixed in 1.3.7 version of Mosh-Pro.<br>"}]}], "references": [{"url": "https://cert.pl/en/posts/2025/08/tcc-bypass/", "tags": ["third-party-advisory"]}, {"url": "https://moshpro.app/", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Karol Mazurek - AFINE Team", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-26T14:02:24.112393Z", "id": "CVE-2025-53811", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-26T14:06:08.863Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-53811", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-26T14:02:24.112393Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-26T14:02:28.403Z"}}], "cna": {"title": "TCC Bypass via misconfigured Node fuses in Mosh-Pro", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Karol Mazurek - AFINE Team"}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mosh-Pro", "product": "Mosh-Pro", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "semver", "lessThanOrEqual": "1.3.6"}], "platforms": ["MacOS"], "defaultStatus": "unknown"}], "datePublic": "2025-08-26T12:19:00.000Z", "references": [{"url": "https://cert.pl/en/posts/2025/08/tcc-bypass/", "tags": ["third-party-advisory"]}, {"url": "https://moshpro.app/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The configuration of Mosh-Pro on macOS, specifically the \"RunAsNode\" fuse enabled, allows a\u00a0local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions.\u00a0\nAcquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Mosh-Pro, potentially disguising attacker's malicious intent.\u00a0\n\nThis issue was fixed in 1.3.7 version of Mosh-Pro.", "supportingMedia": [{"type": "text/html", "value": "The configuration of Mosh-Pro on macOS, specifically the \"RunAsNode\" fuse enabled, allows a&nbsp;local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions.&nbsp;<br>Acquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Mosh-Pro, potentially disguising attacker's malicious intent.&nbsp;<br><br>This issue was fixed in 1.3.7 version of Mosh-Pro.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mosh-pro:mosh-pro:*:*:macos:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "1.3.6", "versionStartIncluding": "0.0.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-31T13:46:44.906Z"}}}, "cveMetadata": {"cveId": "CVE-2025-53811", "state": "PUBLISHED", "dateUpdated": "2026-08-31T13:46:44.906Z", "dateReserved": "2025-07-09T13:42:44.065Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2025-08-26T12:22:55.182Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "platforms": ["MacOS"], "product": "Mosh-Pro", "vendor": "Mosh-Pro", "versions": [{"lessThanOrEqual": "1.3.6", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The configuration of Mosh-Pro on macOS, specifically the \"RunAsNode\" fuse enabled, allows a\u00a0local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions.\u00a0\nAcquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Mosh-Pro, potentially disguising attacker's malicious intent.\u00a0\n\nThis issue was fixed in 1.3.7 version of Mosh-Pro."}, {"lang": "es", "value": "La configuraci\u00f3n de Mosh-Pro en macOS, en concreto la habilitaci\u00f3n de la funci\u00f3n \"RunAsNode\", permite a un atacante local sin privilegios ejecutar c\u00f3digo arbitrario que hereda los permisos TCC (Transparencia, Consentimiento y Control) de Mosh-Pro. El acceso a los recursos adquiridos se limita a los permisos previamente otorgados por el usuario. Acceder a otros recursos que no cumplan con los permisos TCC previamente otorgados solicitar\u00e1 la aprobaci\u00f3n del usuario en nombre de Mosh-Pro, lo que podr\u00eda ocultar las intenciones maliciosas del atacante. Este problema se detect\u00f3 en la versi\u00f3n 1.3.2 de Mosh-Pro. Dado que los autores no respondieron a los mensajes de CNA, se desconoce el estado de la actualizaci\u00f3n."}], "id": "CVE-2025-53811", "lastModified": "2026-08-31T14:17:13.020", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-53811", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-26T14:02:24.112393Z", "version": "2.0.3"}}]}, "published": "2025-08-26T13:15:32.317", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2025/08/tcc-bypass/"}, {"source": "cvd@cert.pl", "url": "https://moshpro.app/"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"created": "2025-08-27T11:21:36.652837+00:00", "updated": "2025-08-27T11:21:36.652912+00:00", "vendors": ["apple", "apple$PRODUCT$macos", "mosh", "mosh$PRODUCT$mosh"]}