Mas0Nshi

A path handling issue exists in the `revisiond` component that allows an application already installed on the system to gain root privileges through local privilege escalation. The issue was caused by insufficient validation during path processing.

A path handling issue exists where improved validation is required. This flaw may allow an application to bypass Gatekeeper checks, which is the system's security feature used to ensure only trusted software runs on the Mac.

A race condition, which occurs when the timing or sequence of events is unplanned, was addressed with improved state handling. This issue could allow an application to gain root privileges.

A race condition exists due to improper handling of symbolic links, which are shortcuts that point to another file or directory. This flaw may allow an application to access Contacts without obtaining user consent.

Happy DOM, a JavaScript implementation of a web browser without a graphical user interface, contains a security issue that could lead to Remote Code Execution (RCE) attacks. The Node.js VM Context within Happy DOM is not fully isolated. Running untrusted JavaScript code within this context may allow it to escape the VM and gain access to process-level functionality. The extent of control an attacker gains depends on whether the process uses ESM or CommonJS. With CommonJS, an attacker can potentially access the `require()` function to import modules. JavaScript evaluation is enabled by default in Happy DOM, which may pose a risk if untrusted code is executed within the environment. Approximately 2.7 million weekly downloads are impacted.

A logic issue was identified and addressed through improved checks within the FrontBoard component. This issue allows an application to potentially enumerate a user's installed applications. Reports indicate that this issue has been exploited by some App Store applications to detect the presence of TrollStore on a device.