CVE-2025-15523
Gravedad CVSS v4.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
22/01/2026
Última modificación:
26/01/2026
Descripción
*** Pendiente de traducción *** MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions<br />
granted by the user to the main application bundle. An attacker with local user access can<br />
invoke this interpreter with arbitrary commands or scripts, leveraging the<br />
application&#39;s previously granted TCC permissions to access user&#39;s files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Inkscape, potentially disguising attacker&#39;s malicious intent.<br />
<br />
This issue has been fixed in 1.4.3 version of Inkscape.
Impacto
Puntuación base 4.0
4.80
Gravedad 4.0
MEDIA