Arduino IDE Privilege Escalation Vulnerability in macOS

A vulnerability in Arduino IDE for macOS, prior to version 2.3.7, allows local users to exploit world-writable file permissions on sensitive application components. This misconfiguration enables the replacement of legitimate files with malicious code. When the application is launched by another user, the injected code executes with that user's privileges, potentially leading to unauthorized access to sensitive data and privilege escalation.

Impact

Exploitation of this vulnerability allows for privilege escalation and unauthorized access to sensitive data on the affected user's account.

Remediation

Users are advised to update Arduino IDE to version 2.3.7 or later. The update is available on the official Arduino software release page.