Cleanshot X
Monthly
Arbitrary code execution in CleanShot X for macOS occurs when the application insecurely deserializes data embedded in a .cleanshot project file, so a crafted editable-screenshot annotation file runs its payload automatically during parsing in the context of the logged-in user. The flaw affects users on release branches below the fixed builds 4.5.2, 4.6.3, 4.7.8 and 4.8.10, and exploitation is gated by mandatory user interaction: the attacker must deliver the malicious file and convince the victim to open it, with local file delivery rather than a network-exposed service. No public exploit code has been identified at time of analysis, and the CERT-PL-sourced report is tracked as a this-week priority rather than an emergency; users who have never opened a .cleanshot file from an untrusted source are explicitly out of scope.
Arbitrary code execution in CleanShot X for macOS occurs when the application insecurely deserializes data embedded in a .cleanshot project file, so a crafted editable-screenshot annotation file runs its payload automatically during parsing in the context of the logged-in user. The flaw affects users on release branches below the fixed builds 4.5.2, 4.6.3, 4.7.8 and 4.8.10, and exploitation is gated by mandatory user interaction: the attacker must deliver the malicious file and convince the victim to open it, with local file delivery rather than a network-exposed service. No public exploit code has been identified at time of analysis, and the CERT-PL-sourced report is tracked as a this-week priority rather than an emergency; users who have never opened a .cleanshot file from an untrusted source are explicitly out of scope.