CVE-2025-69604

CVE-2025-69604 説明 この脆弱性は、CVE-2025-61229で説明されているものと類似しています。攻撃者はタスクテンプレートを編集して、SuperDuperのバックアップタスクに任意のパッケージをインストールさせることができます。その後、パッケージはルートユーザーとして、最高レベルのプライバシーアクセス（フルディスクアクセス）でシェルスクリプトを実行できます。 参考文献 SuperDuper Security Update v3.12 CVE-2025-69604 CVSS 3.1 スコア: NVD スコアは保留中です。 緩和策...

CVE-2025-61228

CVE-2025-61228 注意 この問題は開発者が示唆するよりも深刻なようです。そのため、この部分が埋もれてしまわないようにしたいと思います。開発者はブログで次のように述べています: これは、お使いのシステム上で動作中のプログラムが SuperDuper の更新を探していて、正規の手段で実際の更新が提示され、あなたが「アップグレード」をクリックした場合にのみ発生します。 これは実際には正しくありません。この脆弱性を悪用するために、正規の手段で実際の更新が提示される必要はありません。SuperDuper 3.10 以前が提供する更新は、絶対に受け入れないでください!...

CVE-2025-61229

CVE-2025-61229 説明 開発者のブログより: ユーザーが設定可能な Before/After シェルスクリプトは、SuperDuper の TCC フルディスクアクセス権限で昇格して実行されます。これらのシェルスクリプトはコピーまたはスケジュールの設定ファイルから参照されるため、悪意のある攻撃者がその設定を変更して自分のスクリプトを実行させる可能性があります。 CVE より: Shirt Pocket の SuperDuper! 3.10 以前の問題により、ローカルの攻撃者がデフォルトのタスクテンプレートを変更し、任意の preflight スクリプトを root...

CVE-2025-57489

CVE-2025-57489 説明 開発者のブログより： SuperDuperのロックが解除され、管理者パスワードを入力せずに実行できるようになると、サードパーティのプログラムがその認可を利用して、バックアップ以外のものを管理者権限で実行する可能性があります。 CVE説明： Shirt Pocket SuperDuper! v3.10のSDAgentコンポーネントにおける不適切なアクセス制御により、setuidバイナリの不適切な使用により攻撃者が権限をrootに昇格させることができます。 帰属...

Superduper: Remote code execution via unsafe eval in superduper query parsing

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The parseoppart function in query.py uses the unsafe eval function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although...

PYSEC-2026-3077 Superduper: Remote code execution via unsafe eval in superduper query parsing

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The parseoppart function in query.py uses the unsafe eval function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although...

CVE-2026-31225

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The parseoppart function in query.py uses the unsafe eval function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although...

Superduper: Remote code execution via unsafe eval in superduper query parsing

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The parseoppart function in query.py uses the unsafe eval function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although...

GHSA-2799-6G5R-MMC7 Superduper: Remote code execution via unsafe eval in superduper query parsing

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The parseoppart function in query.py uses the unsafe eval function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although...

Arbitrary Code Injection

Overview superduper-framework is a Build compositional and declarative AI applications and agents Affected versions of this package are vulnerable to Arbitrary Code Injection in the parseoppart function due to the use of eval on user-supplied input without adequate sanitization or restriction. An...

CVE-2026-31225

The superduper project (versions through v0.10.0 ) is vulnerable to critical remote code execution (RCE) due to an unsafe use of the eval() function within the _parse_op_part() function of the query.py file. While the software attempts to restrict the execution context via a limited global namesp...

superduper 安全漏洞

Superduper is an open-source database integration AI proxy and application building tool developed by superduper.io. Versions of Superduper prior to v0.10.0 contained security vulnerabilities. These vulnerabilities stemmed from the Parseoppart function in the query parsing component, which used t...

CVE-2026-31225

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The parseoppart function in query.py uses the unsafe eval function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although...

CVE-2026-31225: Improper Control of Generation of Code

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The parseoppart function in query.py uses the unsafe eval function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although...

CVE-2025-69604

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2025-69604

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2025-69604

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2025-69604: Incorrect Default Permissions

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

PT-2026-5345

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2025-69604

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls...