CVE-2026-59111

CriticalCVSS 9.3/10Last modified Sep 1, 2026

Description

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Aug 31, 2026
Last modified
Sep 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-591124.4Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian InformatCVE-2026-591138.8Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-591159.9'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.CVE-2026-591166.8Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature overCVE-2026-591177.5Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network.CVE-2026-591189.3Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.CVE-2026-591197.3Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.CVE-2026-59128.8Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a CVE-2026-591227.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorizeCVE-2026-591249.8Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a CVE-2026-591257.0Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.CVE-2026-591267.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an autho
CVE-2026-59111: Critical severity, CVSS 9.3 | Vulnix