Apple CVE-2026-34779

The CVSS 6.5 score reflects a moderate overall severity driven by high confidentiality and integrity impact (C:H, I:H) but limited by local attack vector (AV:L) and high attack complexity (AC:H), which requires specific conditions and user interaction (UI:R). The EPSS probability of exploitation is not provided in the input data. However, key mitigating factors reduce real-world risk: (1) the vulnerability requires an attacker to control or influence the installation path of an Electron application, (2) user must explicitly accept the move-to-Applications dialog, and (3) attack surface is macOS-only. Conversely, aggravating factors increase concern: (1) Electron is widely used in desktop applications (VS Code, Slack, Discord, etc.), so the attack surface is large, (2) if an attacker can compromise an app installer or control download paths, the user-interaction barrier is plausible, and (3) successful exploitation grants full code execution in the app's context. Using SSVC framing: exploitation is not yet confirmed as active (no KEV or public POC noted), technical impact is severe (code execution), and automatable attack is moderately feasible if an attacker controls the installation context. Verdict: this is a real priority for Electron-dependent applications, especially those distributed via third-party channels or where installation paths may be user-controllable; however, it is not a critical emergency for in-house deployments where installation integrity is maintained.

An attacker crafts a malicious installer or compromises a download source, causing an Electron application to be installed in a directory with a specially crafted name containing AppleScript metacharacters (e.g., /Applications/MyApp'; rm -rf /; echo '.app). When the user first launches the application and accepts the moveToApplicationsFolder() dialog prompt to move the app to the standard Applications folder, the vulnerable code constructs an AppleScript command that includes the malicious path string unescaped. The AppleScript injection causes arbitrary commands to execute with the user's privileges, granting the attacker code execution in the application's security context. No public exploit proof-of-concept has been identified at time of analysis.