CVE-2026-59111: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in Ministry of the Interior (MVČR) eObčanka-Identifikace

The vulnerability CVE-2026-59111 involves improper neutralization of special elements used in OS commands (CWE-78) in the eObčanka-Identifikace software by the Ministry of the Interior (MVČR) on MacOS. Specifically, before version 3.6.0, the software allows an attacker to register a custom URL scheme (czeeopauth://) that passes incoming URL parameters directly to a compiled AppleScript wrapper using string concatenation without sufficient sanitization. This can lead to OS command injection, enabling an attacker to execute arbitrary commands with the privileges of the affected application. The vulnerability is rated critical with a CVSS 3.1 score of 9.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and complete confidentiality and integrity impact. No patch or official remediation information is currently available.

Successful exploitation could allow an attacker to execute arbitrary OS commands on the affected MacOS system through the vulnerable AppleScript wrapper, potentially compromising confidentiality and integrity of the system. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions and restrict access to the vulnerable application to trusted users only.