CVE-2026-16477: Insecure Deserialization of .cleanshot Files in CleanShot X
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CleanShot X for macOSto a version that resolves this vulnerability.Fixed in 4.5.2
Event History
Frequently Asked Questions
Who is exposed to exploitation?
CleanShot X users are exposed only if they open a malicious .cleanshot project file from an untrusted source. Users who have never opened an untrusted .cleanshot file are not affected.
What must an attacker do to exploit this issue?
The attacker must craft a malicious .cleanshot file, deliver it to the target, and convince the target to open it. Code execution occurs automatically while CleanShot X parses the file, in the context of the current user.
Which versions contain a fix?
The issue was fixed in CleanShot X versions 4.5.2, 4.6.3, 4.7.8, and 4.8.10.