Vulnerability in MTW CleanShot X software

CERT Polska has received a report about vulnerability in MTW CleanShot X software and participated in coordination of its disclosure.

The vulnerabilityCVE-2026-16477: CleanShot X for macOS insecurely deserializes untrusted data embedded in a.cleanshotproject file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious.cleanshotfile, deliver it to the target, and have the target open it; the payload is then executed automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a.cleanshotfile from an untrusted source are not affected by this vulnerability.

This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10

We thank Dharan24 for finding the vulnerability.