CVE-2025-11921: iStats Privilege Escalation Vulnerability

CVE-2025-11921 Overview

CVE-2025-11921 is a local privilege escalation vulnerability in iStat Menus version 7.10.4 for macOS. The application ships an insecure XPC (Cross-Process Communication) service that fails to sanitize input before passing it to a privileged command execution routine. An unprivileged local user can send crafted requests to the service and inject shell commands that execute as root. The flaw is classified under [CWE-77] (Improper Neutralization of Special Elements used in a Command).

Critical Impact
Any local user on an affected macOS host can escalate to root by abusing the iStat Menus XPC helper, resulting in full system compromise.

Affected Products

Bjango iStat Menus 7.10.4 (macOS)
Prior 7.x releases exposing the same XPC helper (see vendor advisory)
Fixed in iStat Menus 7.10.6

Discovery Timeline

2025-11-24 - CVE-2025-11921 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11921

Vulnerability Analysis

iStat Menus installs a privileged helper that exposes an XPC service to communicate with the unprivileged user-interface component. XPC endpoints on macOS run under the privileges of the helper, which in this case is root. The helper accepts parameters from clients and forwards them to a system command execution path without validating or escaping shell metacharacters. This design allows a caller to break out of the intended argument context and append arbitrary commands that the helper then runs with elevated rights.

Because the vulnerable service is reachable from any local session, attackers do not need to defeat memory protections or exploit race conditions. A single crafted XPC message is sufficient to obtain root, making this a reliable post-compromise escalation primitive for malware, malicious insiders, or attackers who obtained a foothold through phishing.

Root Cause

The root cause is improper neutralization of special elements in command strings passed to the privileged XPC handler. The service treats client-supplied input as trusted data and concatenates it into a command line rather than using an argument vector with strict allow-listed values. Additionally, the XPC connection lacks sufficient client validation to restrict callers to the legitimate iStat Menus GUI process.

Attack Vector

Exploitation requires local access with standard user privileges and no user interaction. An attacker enumerates the Mach service name exported by the iStat Menus helper, establishes an XPC connection, and issues a request containing shell metacharacters (for example, backticks, semicolons, or $() substitution) inside a parameter that the helper forwards to a shell. The helper executes the injected payload as root, giving the attacker full control of the host. See the Fluid Attacks Security Advisory for technical specifics.

Detection Methods for CVE-2025-11921

Indicators of Compromise

Unexpected child processes of the iStat Menus privileged helper running as root, particularly /bin/sh, /bin/bash, osascript, or curl.
New LaunchDaemons, cron jobs, or SSH authorized keys created shortly after iStat Menus helper activity.
Unusual XPC connections to the iStat Menus Mach service from processes other than the signed iStat Menus GUI.

Detection Strategies

Monitor process ancestry on macOS endpoints for root-owned shell or scripting processes whose parent is the iStat Menus helper binary.
Alert on command lines containing shell metacharacters passed as arguments to the helper.
Baseline installed versions of iStat Menus across the fleet and flag hosts still running 7.10.4 or earlier.

Monitoring Recommendations

Enable macOS Endpoint Security telemetry (ES_EVENT_TYPE_NOTIFY_EXEC) and forward events to a central data lake for retrospective hunting.
Track privileged helper installations in /Library/PrivilegedHelperTools/ and validate code signatures on each check-in.
Correlate local logon events with subsequent root-level process creation to surface privilege escalation attempts.

How to Mitigate CVE-2025-11921

Immediate Actions Required

Upgrade iStat Menus to version 7.10.6 or later on every macOS endpoint. The vendor package is available at iStat Menus 7.10.6.
Inventory macOS hosts with iStat Menus installed and prioritize multi-user or shared systems.
Restrict local logon on sensitive systems until patching is complete.

Patch Information

Bjango released iStat Menus 7.10.6, which remediates the command injection in the XPC helper. Review the Bjango iStat Menus product page and the Fluid Attacks Security Advisory for full patch details and version notes.

Workarounds

Uninstall iStat Menus from hosts that cannot be updated promptly, including removing the privileged helper from /Library/PrivilegedHelperTools/.
Remove and unload the associated LaunchDaemon so the vulnerable XPC service is no longer reachable.
Limit interactive local accounts on affected systems to trusted administrators until the patched version is deployed.

bash

# Verify installed version and remove the privileged helper if patching is delayed
defaults read /Applications/iStat\ Menus.app/Contents/Info.plist CFBundleShortVersionString
sudo launchctl unload /Library/LaunchDaemons/com.bjango.istatmenus*.plist
sudo rm -f /Library/PrivilegedHelperTools/com.bjango.istatmenus*
sudo rm -f /Library/LaunchDaemons/com.bjango.istatmenus*.plist