Canva for Mac Local Code Execution Vulnerability via TCC Permissions
Vulnerability
A vulnerability exists in the Canva for Mac desktop application distributed through the Mac App Store, prior to version 1.117.1. This version was released without the Hardened Runtime, allowing a local threat actor with unprivileged access to execute arbitrary code that could inherit the TCC (Transparency, Consent, and Control) permissions assigned to Canva.
Impact
Exploitation of this vulnerability could lead to unauthorized execution of code with elevated permissions, potentially allowing for more significant system access or control.
Remediation
Users are advised to upgrade to the latest version of the Canva application via the Mac App Store.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.