Inkscape TCC Bypass Vulnerability on MacOS

A vulnerability exists in the MacOS version of Inkscape, where the bundled Python interpreter inherits Transparency, Consent, and Control (TCC) permissions from the main application. This allows an attacker with local user access to execute arbitrary commands or scripts via the Python interpreter, using the application's TCC permissions to access files in privacy-protected folders without user prompts. While accessing resources beyond the granted TCC permissions would trigger a user approval request in the name of Inkscape, potentially masking the attacker's intent, this vulnerability could still be exploited to access sensitive files. This issue affects all Inkscape versions prior to 1.4.3 on MacOS.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user files in privacy-protected folders, bypassing normal TCC permission prompts.

Remediation

Users can update to Inkscape version 1.4.3 or later to address this vulnerability.