A critical OS command injection vulnerability in the eObčanka-Identifikace macOS application allows unauthenticated attackers to achieve arbitrary command execution through malicious URL schemes.

The application improperly neutralizes special characters when processing parameters for the custom czeeopauth:// URL scheme. These parameters are passed directly to an AppleScript wrapper via concatenation, allowing unauthenticated attackers to escape the intended execution context and run arbitrary OS commands.

The exploitation of this flaw leads to a complete compromise of the affected macOS system, as the attacker gains the ability to execute arbitrary commands with the privileges of the logged-in user. Given the CVSS score of 9.3, this represents a critical risk that could lead to unauthorized data access, the installation of persistent backdoors, or lateral movement within the organization.

Immediate Action: Update the eObčanka-Identifikace application to version 3.7.0 or later, which removes the vulnerable AppleScript components entirely.

Proactive Monitoring: Monitor system logs for suspicious process spawning related to the eObčanka application and investigate any unusual activity triggered by the czeeopauth:// URL protocol.

Compensating Controls: Implement endpoint protection policies to restrict the execution of unauthorized scripts or binaries initiated by the eObčanka-Identifikace process.

Public Exploit Available: Unknown

Due to the critical severity and the potential for full system compromise, administrators must prioritize upgrading all macOS instances of eObčanka-Identifikace to version 3.7.0. The complete removal of the vulnerable AppleScript component in this release provides the most robust security posture against this class of attack.