Live › vulnerability › CVE-2026-119250
WiFiman Desktop for macOS has an external control of file name or path flaw that lets a local user with low privileges run arbitrary commands as root. The sources give no further technical detail on the exact code path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Macs with WiFiman Desktop 1.2.8 or earlier installed. An attacker needs a local low-privilege account and can then run commands as root, so shared or multi-user Macs matter most. Windows and Linux builds are not named in the bulletin, and Macs without the app can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WiFiman Desktop for macOS | vendor | <= 1.2.8 | 1.3.0 |
1.2.8 and earlier are affected; or later is fixed1.3.0brew list --cask --versions wifimanUpdate WiFiman Desktop for macOS to version 1.3.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.
This page as .md · .json · in your agent: get_signal("CVE-2026-119250")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.