Read the docs
TI-2025-33705 Aliases CVE-2025-53811GHSA-p5h8-h669-x47q

TCC Bypass via misconfigured Node fuses in Mosh-Pro

Priority LOW 21CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions.  Acquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Mosh-Pro, potentially disguising attacker's malicious intent.  This issue was fixed in 1.3.7 version of Mosh-Pro.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00131 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Mosh-ProMosh-Pro0.0.0 – 1.3.6—No fix listedCNA
  • Mosh-Pro VendorMosh-Pro Affected 0.0.0 – 1.3.6 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53811
  2. 2026-10-03 Alias added: GHSA-p5h8-h669-x47q

References

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences