EUVD-2026-34977
GHSA-5m7x-g9jc-x5g7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged shell
-
DeliveryLocate clash-verge-service IPC socket
-
ExploitConnect to world-reachable endpoint
-
ExecutionSend crafted IPC command to privileged service
-
PersistService executes operation with elevated rights
-
ImpactEscalate to root-equivalent privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Requires a local unprivileged account on a macOS or Linux host where Clash Verge Rev and its companion privileged clash-verge-service (using clash-verge-service-ipc < 2.3.0) are installed and the service is running, exposing the Unix-domain IPC socket with the overly permissive default permissions. No authentication to the IPC itself, no user interaction, and no non-default configuration are needed - the world-reachable socket is the default. Limiting factors: attacker must already have local code execution on the box, the vulnerable service must be installed and active, and Windows deployments appear out of scope per the upstream changelog note scoping the IPC permission tightening to macOS and Linux. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.4 and accurately reflects a high-impact local issue: an attacker needs only a local unprivileged shell, no authentication to the IPC, no user interaction, and gains full confidentiality, integrity, and availability impact on the host once they reach the privileged service. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so real-world exploitation is unconfirmed; however, the precondition (having any local account on a desktop that installed Clash Verge) is trivial on multi-user macOS/Linux systems, and the patch diff plus the published research write-up at kaguranaku.me make reverse-engineering an exploit straightforward. Note one data-fit caveat: the CPE only lists clash_verge_rev:clash-verge-service-ipc, but the vulnerable component is the privileged service binary paired with this IPC crate - Windows users are likely unaffected because the changelog explicitly scopes the hardening to macOS and Linux, which the bare CVSS does not convey. |
| Exploit ScenarioDerived | An unprivileged local user on a shared macOS or Linux workstation that has Clash Verge installed locates the world-reachable IPC socket created by the privileged clash-verge-service, connects to it, and issues IPC commands that the service executes with its elevated privileges. Depending on the exposed RPC surface (proxy/route/TUN configuration, service control), this yields effective privilege escalation to the service account, which on these platforms is typically root. No public PoC is identified at time of analysis, but the patch diff and the public write-up at kaguranaku.me describe the issue in enough detail to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 06, 2026
Local privilege escalation in clash-verge-service-ipc before 2.3.0 allows unprivileged local users on macOS and Linux to interact with a world-reachable IPC socket exposed by the privileged Clash Verge service, enabling them to invoke service operations that run with elevated rights. The upstream fix (PR #23) restricts IPC permissions to 0750 on the directory and 0660 on the socket, and the patched dependency was incorporated into the Clash Verge Rev desktop client. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.
RemediationAI
Vendor-released patch: upgrade clash-verge-service-ipc to 2.3.0 or later, which lands PR #23 restricting the IPC directory mode to 0750 and the socket mode to 0660; end users of the Clash Verge Rev desktop client should update to a Clash Verge Rev build that includes commit 3bbcdbe (which pins clash_verge_service_ipc 2.0.27 and consumes the v2.3.0 IPC). Advisory URLs: https://github.com/clash-verge-rev/clash-verge-service-ipc/releases/tag/v2.3.0 and https://github.com/clash-verge-rev/clash-verge-rev/commit/3bbcdbe5caacc2ffb713af69f2c93e202573f918. If immediate upgrade is not possible, manually chmod the IPC socket directory to 0750 and the socket file to 0660 owned by the appropriate service user/group, or uninstall the background privileged service and run Clash Verge without service-mode TUN/system-proxy features - the trade-off being loss of transparent proxying and any function that requires elevated networking privileges. On shared/multi-user macOS or Linux hosts, treat upgrade as urgent because every local account is currently in the trust boundary.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Clash Verge Rev is a Tauri-based desktop GUI for the Clash/Mihomo proxy core that ships with a companion privileged background service (clash-verge-service) which the unprivileged UI process talks to over a local IPC channel implemented by the clash-verge-service-ipc Rust crate. On Unix-like systems this IPC is exposed via a filesystem socket whose containing directory and socket node had overly permissive modes, allowing any local user - not just members of an authorized group - to open and send commands to the privileged endpoint. This is a textbook CWE-732 (Incorrect Permission Assignment for Critical Resource) issue: the security boundary between unprivileged callers and the root/Administrator-level service relies on filesystem permissions, and those permissions were effectively world-reachable. The fix (clash-verge-service-ipc PR #23, shipped in v2.3.0) tightens the modes to 0750 for the directory and 0660 for the socket so only the owning user and group can open the channel.
Know when Clash Verge Service Ipc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
1DescriptionCVE.org
clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.
Executive ViewAI
Clash Verge service (versions before 2.3.0) on macOS and Linux systems allows unprivileged local users to gain administrative access through an improperly secured inter-process communication socket, creating a direct pathway for privilege escalation attacks. This exposes any organization using Clash Verge to account compromise and potential lateral movement from affected endpoints. Immediate assessment and remediation are required to maintain endpoint security posture.
No vendor-released patch identified at time of analysis. Interim mitigations: Apply upstream file permission fixes (0750 on socket directory, 0660 on socket); restrict local system access to essential personnel only; disable Clash Verge on systems where not operationally required; implement and monitor for local privilege escalation detection alerts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB