Local Code Execution Vulnerability in Mosh-Pro on macOS
CVE-2025-53811

4.8MEDIUM

Key Information:

Vendor

Mosh-pro

Status
Mosh-pro
Vendor
CVE Published:
26 August 2025

What is CVE-2025-53811?

A local code execution vulnerability has been identified in Mosh-Pro for macOS, specifically related to the 'RunAsNode' fuse enabled configuration. This flaw allows an unprivileged local attacker to execute arbitrary code that inherits TCC (Transparency, Consent, and Control) permissions granted to Mosh-Pro by the user. While the access gained is limited to previously granted permissions, the attack could mislead users, as any attempts to access additional resources will prompt user approval under the guise of Mosh-Pro, obscuring the attacker's true intentions. Notably, this issue was identified in version 1.3.2 of Mosh-Pro, and the current status of a patch is uncertain due to a lack of response from the developers.

Affected Version(s)

Mosh-Pro MacOS 1.3.2

References

https://cert.pl/en/posts/2025/08/tcc-bypass/
third-party-advisory
https://moshpro.app/
product

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karol Mazurek - AFINE Team
.
CVE-2025-53811 : Local Code Execution Vulnerability in Mosh-Pro on macOS