Critical · published December 23, 2022
🚨 A crafty browser visit could turn your Mac into a command center for an attacker! 😱 Think of it like a restaurant where the waiter serves a dish that sounds amazing, but the chef's decided to slip in a surprise ingredient that could make you sick — that's what's happening in ActivityWatch with this vulnerability! 🍽️ An attacker could take over your system and execute any command they wish, potentially stealing sensitive data or messing with your files. This is absolutely devastating if you're tracking valuable time or any sensitive activities on your Mac. 🔥
Think of it like a restaurant where the waiter serves a dish that sounds amazing, but the chef's decided to slip in a surprise ingredient that could make you sick — that's what's happening in ActivityWatch with this vulnerability! 🍽️ This vulnerability allows an attacker to execute arbitrary commands by setting a malicious page title when a user visits a compromised website, exploiting ActivityWatch running on macOS versions before 0.11.0.
An attacker could take over your system and execute any command they wish, potentially stealing sensitive data or messing with your files. This is absolutely devastating if you're tracking valuable time or any sensitive activities on your Mac. 🔥 Upgrade ActivityWatch to the latest version (0.11.0) immediately to patch this vulnerability. If you can't upgrade right away, consider running the latest version of aw-watcher-window from source or manually patching the `printAppTitle.scpt` file as a temporary fix. You've got this! With just a few steps, you'll be back to tracking your time safely and securely. 🛡️