CVE-2026-59111 Command Injection vulnerability in eObčanka-Identifikace
An attacker can execute arbitrary OS commands via crafted URL parameters in the eObčanka-Identifikace macOS application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-59111?
CVE-2026-59111 is a critical command injection vulnerability in Ministry of the Interior (MVČR) eObčanka-Identifikace, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.
Weakness: CWE-78
Which versions are affected by CVE-2026-59111?
How do I fix CVE-2026-59111?
No fix has been published for CVE-2026-59111 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-59111 being exploited?
There is no known exploitation of CVE-2026-59111 in the wild and no public exploit code.
Sources
Also known as GHSA-vj9g-x7fg-rr79.