The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute… (CVE-2025-53811)

The vulnerability in Mosh-Pro on macOS arises from its configuration with the "RunAsNode" fuse enabled. This configuration permits a local attacker with limited privileges to execute arbitrary code that inherits the Transparency, Consent, and Control (TCC) permissions granted to Mosh-Pro. While the attacker can only access resources previously authorized by the user, any attempt to access additional protected resources triggers a user prompt appearing to originate from Mosh-Pro, which may conceal the attacker's true intent. The issue was identified in version 1.3.2. No vendor advisory or patch information is available, and the vendor has not responded to inquiries regarding remediation.

A local unprivileged attacker can execute arbitrary code with the same TCC permissions as Mosh-Pro, potentially accessing sensitive user data or system resources previously granted to Mosh-Pro. User prompts for additional permissions may be misleading, increasing the risk of inadvertent approval of malicious actions. There is no evidence of known exploits in the wild. The impact is limited to the scope of permissions already granted to Mosh-Pro, but the ability to execute arbitrary code elevates the risk of privilege misuse within those bounds.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, limit local unprivileged access to affected systems and monitor for suspicious activity related to Mosh-Pro. Users should be cautious when approving permission prompts appearing under Mosh-Pro's name, as they may be attempts to escalate privileges.