CVE-2026-59111
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.
- Published Aug 31, 2026
- CVSS 9.3 critical
- 1.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available