VORANT. Threat Intelligence Research Create a free account

Inkscape TCC bypass lets attackers access protected macOS files

Published Vorant ratingroutine vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

CVE-2025-15523 allows local attackers to abuse Inkscape's TCC permissions on macOS via bundled Python interpreter to access protected user files without prompts.

Sourcecert.pl — open the original

What to check

Applies to
The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation
No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska coordinated disclosure of CVE-2025-15523, a privilege escalation vulnerability in Inkscape for macOS. The vulnerability stems from Inkscape's bundled Python interpreter inheriting Transparency, Consent, and Control (TCC) permissions granted to the main application. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging already-granted TCC permissions to silently access privacy-protected folders. Attempts to access resources beyond existing permissions will prompt the user, but the prompt appears in Inkscape's name, potentially masking malicious activity.

This is a classic example of TCC inheritance abuse in macOS application bundles. The attack requires prior local access but bypasses macOS privacy protections by piggybacking on legitimate application permissions. The vulnerability was responsibly disclosed by researchers Karol Mazurek and Hubert Decyusz from the AFINE Team and has been patched in Inkscape version 1.4.3.

Organisations using macOS with Inkscape deployed should prioritise updating to version 1.4.3. The vulnerability underscores the risk of bundled interpreters in application packages inheriting broad system permissions without proper isolation.

Mentioned in this report

Vulnerabilities CVE-2025-15523

Related reporting

Detection guidance

Inkscape Bundled Python Interpreter Invoked with Inline Code or Script Argument

ATT&CK T1059.006 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects execution of the Python interpreter bundled inside Inkscape.app with inline code (-c) or arbitrary script arguments, which can be abused to inherit Inkscape's TCC permissions for silent access to privacy-protected data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Inkscape Bundled Python Interpreter Invoked with Inline Code or Script Argument
logsource:
  category: process_creation
  product: macos
detection:
  selection_image:
    Image|contains: python
  selection_args:
    CommandLine|contains:
    - ' -c '
    - ' -m '
    - .py
  filter_expected:
    CommandLine|contains:
    - /Contents/Resources/extensions/
    - inkex
  condition: selection_image and selection_args and not filter_expected
falsepositives:
- Legitimate Inkscape extensions invoking the bundled Python interpreter with scripts
  located under the official extensions directory
- Inkscape developers testing custom extensions during development
level: high
tags:
- attack.t1059.006
- attack.t1068
id: cb56c4ea-cd86-551d-addf-8debfc1481fa
status: experimental
author: Vorant

Inkscape Bundled Python Process Accessing TCC-Protected User Directories

ATT&CK T1068 · status experimental · needs macos file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects file access by the Python interpreter embedded in Inkscape.app to privacy-protected macOS directories (e.g., Photos, Contacts, Messages, Documents), indicating potential abuse of inherited TCC permissions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Inkscape Bundled Python Process Accessing TCC-Protected User Directories
logsource:
  category: file_event
  product: macos
detection:
  selection_image:
    Image|contains: python
  selection_target:
    TargetFilename|contains:
    - /Library/Application Support/com.apple.TCC
    - /Pictures/Photos Library
    - /Library/Messages/
    - /Library/Mail/
    - /Library/Safari/
    - /Contacts/
  condition: selection_image and selection_target
falsepositives:
- User legitimately opening or importing images from Photos library via Inkscape's
  normal file dialogs
- Inkscape extension scripts operating on user-selected files stored in these locations
  with explicit consent
level: high
tags:
- attack.t1068
- attack.t1059.006
id: f5f1c8f1-a022-56e9-a133-d1dc608a4cc7
status: experimental
author: Vorant

Child Process Spawned from Inkscape Bundled Python Interpreter

ATT&CK T1068 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects shell, network, or system utility processes spawned by the Python interpreter bundled inside Inkscape.app, which may indicate exploitation of CVE-2025-15523 to piggyback on Inkscape's TCC permissions for further access or exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Child Process Spawned from Inkscape Bundled Python Interpreter
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|contains: python
  selection_child:
    Image|endswith:
    - /bash
    - /zsh
    - /sh
    - /curl
    - /osascript
    - /nc
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Inkscape extensions that shell out to helper utilities as part of normal
  export or conversion workflows
level: medium
tags:
- attack.t1068
- attack.t1059.006
id: 7a721d2a-136c-5d99-b594-0fd2775c4f57
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-15523

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs