Summary of CVE Vulnerabilities Report on Poedit and Viscosity
In May 2025, CERT Polska reported two distinct vulnerabilities affecting MacOS applications, specifically Poedit and Viscosity. Both vulnerabilities are classified as having incorrect default permissions (CWE-276) and represent significant security issues that could allow unauthorized access to user files.
CVE-2025-4280: Vulnerability in Poedit
- ID: CVE-2025-4280
- Publication Date: May 22, 2025
- Vendor: Poetit
- Affected Versions: From 2.0 to 3.6.3
The vulnerability in Poedit involves an interpreter for Python that inherits transparency, consent, and control (TCC) permissions granted by the user to the main application. An attacker with local access can exploit this interpreter using arbitrary commands or scripts. This allows unauthorized access to protected files without triggering user consent prompts, potentially disguising malicious intent. A key issue is that any further resource access beyond what is allowed by the TCC permissions would require the user to approve, which may lead to unintentional approval due to the Poedit application identity.
This critical vulnerability was addressed in version 3.6.3 of Poedit, which has since been released to rectify the security flaws.
CVE-2025-4412: Vulnerability in Viscosity
- ID: CVE-2025-4412
- Publication Date: May 26, 2025
- Vendor: Plantillas
- Affected Versions: Throughout version 1.11.4
For Viscosity, the flaw arises during the usage of a launch agent that loads the Viscosity_openvpn process from the application bundle. This configuration allows dynamic libraries to be loaded using the TCC identity of Viscosity. While resource access is generally limited, like to the camera or microphone, it primarily relies on user-granted permissions for file resources only. Any attempt to access additional resources necessitates user interaction through system permission prompts, which are designed to enhance security.
This vulnerability was rectified in version 1.11.5 of Viscosity, ensuring that the potential risks associated with unauthorized access are mitigated.
Acknowledgments
CERT Polska has acknowledged the critical role played by Karol Mazurek from the Afine team for responsibly reporting these vulnerabilities. The efforts contribute significantly to the overall safety of software applications used by MacOS users worldwide.
Conclusion
Both reported vulnerabilities expose key risks in user permissions management, highlighting the necessity for ongoing security scrutiny in software development. Users of Poedit and Viscosity are strongly encouraged to update their applications to the latest versions (3.6.3 and 1.11.5, respectively) to protect against these vulnerabilities. For further information about the process of coordinated vulnerability disclosure, individuals can visit the CERT Polska website at cert.pl/en/cvd/.
Overall, these findings serve as a reminder of the importance of vigilance and responsiveness in addressing software vulnerabilities, particularly in applications handling sensitive user data.