CVE-2025-11921CWE-732CWE-77command-injection

CVE-2025-11921

published November 24, 2025

CVSS
8.5
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iStats: 7.10.4.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
Not supplied
EPSS
0.00617 · 48.9th percentile
Weaknesses
CWE-732 · Incorrect Permission Assignment for Critical Resource; CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-11-24T20:15Z
References (3)
https://bjango.com/mac/istatmenus/ · [email protected]https://cdn.istatmenus.app/files/istatmenus7/versions/iStatMenus7.10.6.zip · [email protected]https://fluidattacks.com/advisories/muse · [email protected]
EPSS history
Timeline
  • 24 NOV 14:22Z
    iStat Menus 7.10.4 - Local Privilege Escalation
    cvelistv5