Uncontrolled Search Path Element in Yandex Messenger on MacOS
CVE-2025-5469

7.3HIGH

Key Information:

Vendor

Yandex

Status
Messenger
Vendor
CVE Published:
9 December 2025

What is CVE-2025-5469?

An uncontrolled search path element vulnerability exists in Yandex Messenger for MacOS, allowing attackers to exploit search order hijacking issues. This flaw can be leveraged by manipulating the environment in which the application runs, potentially leading to the execution of malicious code. This impacts versions prior to 2.245 of Telemost, emphasizing the need for users to update to the latest versions for enhanced security.

Affected Version(s)

Messenger MacOS 0 < 2.245

References

https://yandex.com/bugbounty/i/hall-of-fame-products

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Egor Filatov, Positive Technologies
JSON
.