CVE-2025-9474
📋 TL;DR
This vulnerability in Mihomo Party up to version 1.8.1 on macOS allows local attackers to create temporary files with insecure permissions via the enableSysProxy function. Attackers could potentially escalate privileges or manipulate system proxy settings, but exploitation requires local access and is complex. Only macOS users running vulnerable versions of Mihomo Party are affected.
💻 Affected Systems
- Mihomo Party
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, unauthorized system proxy configuration changes, or arbitrary file creation with elevated permissions.
Likely Case
Limited local file manipulation affecting only the user's session, potentially disrupting proxy settings or creating temporary files in accessible locations.
If Mitigated
Minimal impact with proper file permission controls, user isolation, and restricted local access to vulnerable systems.
🎯 Exploit Status
Exploit requires local access and specific conditions. Public proof-of-concept exists but exploitation is described as difficult.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 1.8.1
Vendor Advisory: Not specified in provided references
Restart Required: No
Instructions:
1. Check current version of Mihomo Party. 2. Update to latest version beyond 1.8.1. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable vulnerable function
macOSPrevent execution of the vulnerable enableSysProxy function if not required
Restrict local access
macOSLimit local user access to systems running vulnerable versions
🧯 If You Can't Patch
- Remove or disable Mihomo Party until patching is possible
- Implement strict file permission controls and monitor temporary file creation
🔍 How to Verify
Check if Vulnerable:
Check Mihomo Party version. If version is 1.8.1 or earlier on macOS, system is vulnerable.Check Version:
Check application version in Mihomo Party settings or about dialogVerify Fix Applied:
Verify Mihomo Party version is greater than 1.8.1 and test that enableSysProxy function no longer creates insecure temporary files.📡 Detection & Monitoring
Log Indicators:
- Unusual temporary file creation events
- enableSysProxy function calls with unexpected parameters
- File permission modification attempts
Network Indicators:
- Unexpected system proxy configuration changes
SIEM Query:
Search for process creation events related to Mihomo Party followed by file creation events with insecure permissions