VULNERABILITY INTELLIGENCE

CVE-2021-40531

CVSS score9.8 CRITICAL

EPSS probability33.00%

CISA KEVNot currently listed

Published2021-09-06

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app.

Weakness classification

nvd@nist.gov: CWE-434

Primary references

cve@mitre.org — Exploit, Third Party Advisory
cve@mitre.org — Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Release Notes, Vendor Advisory