CVE-2025-15523

A flaw was found in the MacOS version of Inkscape. This issue allows a local attacker to bypass Transparency, Consent, and Control (TCC) permissions by invoking the bundled Python interpreter with arbitrary commands or scripts. This enables unauthorized access to user files in privacy-protected directories without triggering user prompts. Also, accessing resources beyond previously granted TCC permissions will prompt the user for approval in the name of Inkscape, potentially disguising malicious actions as legitimate operations.

This vulnerability is specific to the MacOS version of Inkscape and do not affect Inkscape as shipped in Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.