CVE-2023-40397 Cross-site scripting in macOS

Critical 9.8 Published 6 Sep 2023 Updated 13 Feb 2025

A remote attacker can execute arbitrary JavaScript code in macOS due to insufficient checks, requiring an OS upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-40397?

CVE-2023-40397 is a critical cross-site scripting vulnerability in Apple Macos, published on 6 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote attacker may be able to cause arbitrary javascript code execution.

Which versions are affected by CVE-2023-40397?

It affects 3 products.

Products include Apple Macos, Webkitgtk Webkitgtk, Wpewebkit Wpe Webkit.

How do I fix CVE-2023-40397?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-40397 being exploited?

There is no known exploitation of CVE-2023-40397 in the wild and no public exploit code.

All Apple Macos vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-40397, GHSA-6x6m-3789-2cmw, UBUNTU-CVE-2023-40397.