Vulnerability · Published Sep 6, 2021 · Assigned by mitre

CVE-2021-40531

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 33.0% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)33.0%top 1.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.sketch.com/updates/#version-75 x_refsource_MISC
https://jonpalmisc.com/2021/11/22/cve-2021-40531 x_refsource_MISC