Insecure deserialization of .cleanshot files in CleanShot X
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
CleanShot X for macOS, in versions from 4.0.0 before 4.5.2, from 4.6.0 before 4.6.3, from 4.7.0 before 4.7.8 and from 4.8.0 before 4.8.10, insecurely deserializes untrusted data embedded in a .cleanshot project file (CWE-502). If a user opens a crafted .cleanshot file, the embedded payload runs automatically during parsing and executes arbitrary code in the context of the current user. Exploitation requires an attacker to deliver the malicious file to the target and have the target open it.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MTW | CleanShot X | 4.0.0 to before 4.5.2; 4.6.0 to before 4.6.3; 4.7.0 to before 4.7.8; 4.8.0 to before 4.8.10 | 4.5.2, 4.6.3, 4.7.8, 4.8.10 | Patch available | CNA |
- CleanShot X VendorMTW Affected 4.0.0 to before 4.5.2; 4.6.0 to before 4.6.3; 4.7.0 to before 4.7.8; 4.8.0 to before 4.8.10 Fixed in 4.5.2, 4.6.3, 4.7.8, 4.8.10 Patch available CNA
Remediation
Update CleanShot X to version 4.5.2, 4.6.3, 4.7.8 or 4.8.10, depending on the release line in use. CISA has not listed this vulnerability in its Known Exploited Vulnerabilities catalog.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA CleanShot X (MTW) Fixed in 4.5.2, 4.6.3, 4.7.8, 4.8.10
Timeline
- 2026-10-22 Threatist record created from CVE-2026-16477
- 2026-10-22 Alias added: GHSA-9gj2-4mhg-73v2
- 2026-10-22 CISA SSVC decision points changed
- 2026-10-22 Priority changed: MEDIUM → LOW
References
Sources
- CVE-2026-16477 · CVE Program
- CVE-2026-16477 · NVD
- FIRST EPSS
- GHSA-9gj2-4mhg-73v2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences