CVE-2025-15523

MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Inkscape, potentially disguising attacker's malicious intent. This issue has been fixed in 1.4.3 version of Inkscape.

• CWE-276

• https://cert.pl/en/posts/2026/01/CVE-2025-15523/
• https://inkscape.org/

Published

Jan 22, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15517A missing authentication check in the HTTP server on TP-Link…8.1
• CVE-2025-15518Improper input handling in a wireless-control administrative…7.2
• CVE-2025-15519Improper input handling in a modem-management administrative…7.2
• CVE-2025-15520The RegistrationMagic WordPress plugin before 6.0.7.2 check…4.3
• CVE-2025-15521The Academy LMS – WordPress LMS Plugin for Complete eLearnin…9.8
• CVE-2025-15522The Uncanny Automator – Easy Automation, Integration, Webhoo…6.4
• CVE-2025-15524The Gallery by FooGallery plugin for WordPress is vulnerable…4.3
• CVE-2025-15525The Ajax Load More – Infinite Scroll, Load More, & Lazy Load…5.3
• CVE-2025-15526The Fancy Product Designer plugin for WordPress is vulnerabl…5.3
• CVE-2025-15527The WP Recipe Maker plugin for WordPress is vulnerable to In…4.3
• CVE-2025-15528A vulnerability has been found in Open5GS up to 2.7.6. Affec…7.5
• CVE-2025-15529A vulnerability was found in Open5GS up to 2.7.6. Affected b…7.5