Read the docs
TI-2025-14162 Aliases CVE-2025-15523GHSA-2rgp-qxg7-fcg5

TCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.app

Priority LOW 21CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Inkscape, potentially disguising attacker's malicious intent. This issue has been fixed in 1.4.3 version of Inkscape.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Fix Fixed Inkscape (Inkscape): 1.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
InkscapeInkscapebefore 1.4.31.4.3Patch availableCNA
  • Inkscape VendorInkscape Affected before 1.4.3 Fixed in 1.4.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:inkscape:inkscape:*:*:*:*:*:*:*:*——Inkscape
  • cpe:2.3:a:inkscape:inkscape:*:*:*:*:*:*:*:* Versions — — ·Inkscape

Remediation

  • Fix · CNA Inkscape (Inkscape) Fixed in 1.4.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-15523
  2. 2026-10-03 Alias added: GHSA-2rgp-qxg7-fcg5

References

Advisory 1

Other 1

  • TI-2021-18917 Inkscape Out-of-bounds Write CVSS 3.1HIGH 7.8
  • TI-2026-04341 Improper Restriction of XML External Entity Reference in Inkscape CVSS 3.1MEDIUM 6.3
  • TI-2021-18915 Inkscape Access of Uninitialized Pointer CVSS 3.1LOW 3.3
  • TI-2021-18913 Inkscape Out-of-bounds Read CVSS 3.1LOW 3.3
  • TI-2005-03531 Buffer overflow in the SVG importer (style.cpp) of inkscape 0.41 through 0.42.2 might… CVSS 2.0MEDIUM 5.1
  • TI-2007-01406 Format string vulnerability in the whiteboard Jabber protocol in Inkscape before 0.45.1… CVSS 2.0MEDIUM 6.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences