Dynamic Library Injection Vulnerability in Phoenix Code on macOS

CVE-2025-5255

What is CVE-2025-5255?

The Phoenix Code on macOS has a vulnerability related to its configuration that facilitates Dynamic Library (Dylib) injection. This occurs due to certain entitlements granting local attackers, with unprivileged access, the ability to inject malicious code through environment variables such as DYLD_INSERT_LIBRARIES. Although the attack is limited to permissions already granted by users, it allows bypassing Transparency, Consent, and Control (TCC) policies. Importantly, any attempt to access additional resources beyond those previously authorized will provoke a user interaction prompt for permission. The vulnerability has been addressed in a recent code commit.

References