Apple EUVD-2026-20613

Tophat is a mobile application testing harness for macOS that processes custom URL schemes (tophat://) and localhost HTTP requests (http://localhost:29070). The vulnerability stems from insufficient input validation on the 'arguments' query parameter, which flows unsanitized through URL parsing directly into a /bin/bash -c command execution context. This represents a classic command injection vulnerability (CWE-78) where attacker-controlled input is concatenated into shell command strings without proper escaping or sanitization. The localhost listener on port 29070 creates a local attack surface accessible to any process on the macOS system, while the custom URL scheme handler allows cross-application invocation. The lack of confirmation dialogs for previously trusted build hosts eliminates a potential user-interaction barrier that might otherwise mitigate exploitation.