Apple WebKit Command Injection Vulnerability via Web Inspector URL Copying

A command injection vulnerability has been identified in Apple WebKit. This issue arises when a URL is copied from the Web Inspector, potentially leading to unauthorized command execution. The vulnerability is present in WebKit versions bundled with macOS Sequoia 15.3, Safari 18.3, iOS 18.3, and iPadOS 18.3. The root cause of this vulnerability is a privacy issue related to the handling of files, which has been addressed in the latest updates.

Impact

Exploitation of this vulnerability could result in command injection, allowing for unauthorized command execution on the affected system.

Remediation

Users can update to macOS Sequoia 15.3, Safari 18.3, iOS 18.3, or iPadOS 18.3 to address this vulnerability.