CVE-2025-12843CWE-94code-injection

CVE-2025-12843

Medium · published December 12, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

Code Injection using Electron Fuses in waveterm on MacOS allows TCC Bypass.

This issue affects waveterm: 0.12.2.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00212 · 10.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-12-12T21:15Z
Affected products (1)
ProductVersionsFixed in
waveterm/wave_terminalall versions—
References (3)
https://fluidattacks.com/advisories/minutos · [email protected]https://github.com/wavetermdev/waveterm · [email protected]https://fluidattacks.com/advisories/minutos · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 12 DEC 15:23Z
    Code Injection in Wave Term v0.12.2 allowing TCC Bypass
    cvelistv5