Local Code Injection Vulnerability in Invoice Ninja on macOS

CVE-2025-8700

What is CVE-2025-8700?

A local code injection vulnerability exists in Invoice Ninja on macOS due to the presence of the 'com.apple.security.get-task-allow' entitlement. This flaw enables unprivileged local attackers to attach debuggers and manipulate process memory, effectively bypassing security measures like the Hardened Runtime and Apple's Transparency, Consent, and Control (TCC) framework. Exploitation of this vulnerability allows for code injection within the application's context without the necessary security prompts, thereby escalating the risk to users as the attacker can gain access based on previously granted permissions. This issue has been addressed in Invoice Ninja version 5.0.175.

References