Writeup · · 2 min read
User site-packages load inside the root installer, a CVE-2024-27822 variant
Apple taught bash and zsh to skip user config when it escalates during a .pkg install. Python was never taught. An attacker drops one module in site-packages and it runs as root on the next package the user installs.
#Security#Apple#macOS#methodology