Live › vulnerability › CVE-2026-16477
Go to dashboardCleanShot X for macOS insecurely deserializes data inside a .cleanshot project file, so parsing a crafted file executes attacker-supplied code automatically. An attacker gets arbitrary code execution as the current user once the target opens the file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Users of CleanShot X on macOS who open .cleanshot project files that came from untrusted sources are exposed, since the payload runs when the file is parsed. Users who have never opened such a file from an untrusted source are not affected, and the sources do not describe a server-side or network trigger.
No product ranges from the sources yet.
.cleanshot files received from outside the team that were opened in the app.4.5.2, 4.6.3, 4.7.8 or 4.8.10, matching your major release line..cleanshot project files from untrusted sources until updated.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10
This page as .md · .json · in your agent: get_signal("CVE-2026-16477")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.