CVE-2025-9474CWE-377CWE-378

Mihomo Party Socket sysproxy.ts enableSysProxy temp file

Low · published August 26, 2025

CVSS v4.0
2.0
EPSS
0%
Percentile
2.9
In the wild
Unconfirmed
What it is

A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with insecure permissions. The attack requires a local approach. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit is now public and may be used.

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00138 · 2.9th percentile
Weaknesses
CWE-377 · Insecure Temporary File; CWE-378 · Creation of Temporary File With Insecure Permissions
Published
2025-08-26T05:02Z
EPSS history
Timeline
  • 26 AUG 05:02Z
    Mihomo Party Socket sysproxy.ts enableSysProxy temp file
    cvelistv5