Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

Arturia Software Center installs vulnerable uninstall script on MacOS

CVE-2026-24063 · published 7 months ago
Summary

When installing plugins, Arturia Software Center leaves a script on your Mac that can be edited by anyone. If an attacker changes this script, they could gain elevated access to your Mac. To avoid this, do not install plugins from untrusted sources, and consider reinstalling plugins using a more secure method.

Original advisory text
When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777...
When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-276Incorrect Default Permissions
Timeline
Published18 Mar 2026
Updated4 Nov 2026
First seen18 Mar 2026
Sources
CVE-2026-24063 · NVD
Track software like this
Free during beta