iOS18.6.2-Persistent-Automation-Exploit-in-Siri-Shortcuts-and-Apple-SWC

Siri快捷指令和共享网页凭据中的不当输入验证 发现者： Joseph Goydish II 发现日期： 2025年8月20日 严重性： 高 执行摘要 本报告概述了一个影响Apple Siri快捷指令和共享网页凭据（SWC）框架的高严重性漏洞链。这些缺陷允许恶意构造的载荷在后台静默执行，绕过输入验证、沙箱和用户提示。这些工作流在重启和重新启动后仍然存在，并且可以在没有适当授权的情况下触发敏感系统守护进程。 关键后果 恶意构造的快捷指令工作流在后台静默执行 来自系统守护进程的未授权沙箱扩展请求 swcd 中的持续重试风暴（观察到71+次重试） TLS信任降级——容忍证书不匹配...

CVE-2026-0758

mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of mcp-server-siri-shortcuts. An attacker must first obtain the ability to execute low-privileged code on the...

Command Injection

Overview mcp-server-siri-shortcuts is a MCP server that provides access to Siri shortcuts Affected versions of this package are vulnerable to Command Injection via the shortcutName parameter. An attacker can execute arbitrary code with elevated privileges by supplying crafted input that is used i...

CVE-2026-0758

mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of mcp-server-siri-shortcuts. An attacker must first obtain the ability to execute low-privileged code on the...

CVE-2026-0758

Summary of CVE-2026-0758 (mcp-server-siri-shortcuts) : A local privilege-escalation command-injection flaw in the shortcutName parameter of mcp-server-siri-shortcuts. The issue arises from insufficient validation of a user-supplied string before it is used in a system call, allowing a low-privile...

Siri Shortcuts MCP Server: Operating System Command Injection Vulnerability

Siri Shortcuts MCP Server is a tool developed by David as an integrated voice assistant and a context-based protocol server for large models. The Siri Shortcuts MCP Server has a vulnerability related to operating system command injection, which stems from insufficient validation of the shortcutNa...

(0Day) mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of mcp-server-siri-shortcuts. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...