CVE-2026-59111 CRITICAL 9.3
Published: 2026-08-31 15:17:35 UTC · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Categories: macOS / Apple
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informa?ní agentura (DIA) eOb?anka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.
Weakness: CWE-78