CVE-2025-9474

A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with insecure permissions. The attack requires a local approach. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit is now public and may be used.

Score

CVSS 3.1 4.5 Medium

Status

Deferred - cna@vuldb.com

Published

2025-08-26

Last modified

2025-09-05

Weaknesses

CWE-377, CWE-378

Affected products

• Party (Mihomo)

References

• https://github.com/SwayZGl1tZyyy/n-days/blob/main/mihomo-party/README.md
• https://github.com/SwayZGl1tZyyy/n-days/blob/main/mihomo-party/README.md#proof-of-concept-1
• https://vuldb.com/?ctiid.321343
• https://vuldb.com/?id.321343
• https://vuldb.com/?submit.634656