CVE-2025-54595: Pearcleaner Privilege Escalation Flaw

CVE-2025-54595 Overview

CVE-2025-54595 is a local privilege escalation vulnerability in Pearcleaner, a source-available macOS application cleaner. Versions 4.4.0 through 4.5.1 ship a privileged helper tool, PearcleanerHelper, that runs as a LaunchDaemon with root privileges once the user approves the initial system prompt. The helper registers an XPC service named com.alienator88.Pearcleaner.PearcleanerHelper and accepts unauthenticated connections from any local process. Because the exposed method executes arbitrary shell commands, any local unprivileged user can escalate to root. The issue is fixed in version 4.5.2. The vulnerability is classified under [CWE-78] (OS Command Injection).

Critical Impact
Any local unprivileged user on a macOS system with Pearcleaner 4.4.0–4.5.1 installed and the helper approved can execute arbitrary shell commands as root.

Affected Products

Pearcleaner versions 4.4.0 through 4.5.1
PearcleanerHelper privileged helper tool (LaunchDaemon)
macOS systems where the helper has been user-approved

Discovery Timeline

2025-08-01 - CVE-2025-54595 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54595

Vulnerability Analysis

Pearcleaner bundles a privileged helper, PearcleanerHelper, that is installed as a LaunchDaemon and runs as root after the user approves a one-time system prompt. The helper exposes an XPC service, com.alienator88.Pearcleaner.PearcleanerHelper, intended to service the main Pearcleaner application. In vulnerable releases the helper does not validate the identity of the connecting client. Any local process can connect to the XPC endpoint and invoke a method that executes arbitrary shell commands. Because the helper runs with root privileges, command execution occurs in the root security context. This is a local privilege escalation primitive that requires only that Pearcleaner has previously been approved on the system.

Root Cause

The root cause is missing client validation on the XPC listener. The helper's NSXPCListener delegate accepted new connections without verifying the code signature, team identifier, or process identity of the peer. Combined with an exposed method that passes attacker-controlled input to a shell, this yields OS command injection ([CWE-78]) executed as root.

Attack Vector

An attacker with an unprivileged local account on a macOS host connects to the LaunchDaemon-registered XPC service and invokes the shell-executing method with an arbitrary command. The helper executes the command as root, granting full system compromise. No additional authentication is required beyond the initial helper approval performed earlier by any user of the machine.

swift

// Excerpt from the fix in PearcleanerHelper/CodesignCheck.swift
// Source: https://github.com/alienator88/Pearcleaner/commit/69afadfa95791cb998118ca35c227007b230b984
import Foundation
import Security

let kSecCSDefaultFlags = 0

enum CodesignCheckError: Error {
    case message(String)
}

struct CodesignCheck {

    // MARK: - Compare Functions

    public static func codeSigningMatches(pid: pid_t) throws -> Bool {
        return try self.codeSigningCertificatesForSelf() == self.codeSigningCertificates(forPID: pid)
    }

    // MARK: - Public Functions

    public static func codeSigningCertificatesForSelf() throws -> [SecCertificate] {
        guard let secStaticCode = try secStaticCodeSelf() else { return [] }
        return try codeSigningCertificates(forStaticCode: secStaticCode)
    }
}

The patch introduces CodesignCheck so the helper can compare the connecting process's code-signing certificates against its own before accepting the XPC connection.

Detection Methods for CVE-2025-54595

Indicators of Compromise

Presence of the LaunchDaemon plist for com.alienator88.Pearcleaner.PearcleanerHelper alongside a Pearcleaner version between 4.4.0 and 4.5.1.
Unexpected child processes of PearcleanerHelper such as /bin/sh, /bin/bash, or /usr/bin/osascript running with uid 0.
XPC connections to com.alienator88.Pearcleaner.PearcleanerHelper originating from binaries other than the signed Pearcleaner app bundle.

Detection Strategies

Inventory macOS endpoints for installed Pearcleaner versions and flag any host running 4.4.0 through 4.5.1.
Alert on process creation where the parent is PearcleanerHelper and the child is a shell or interpreter executing arbitrary commands.
Hunt for non-Pearcleaner processes issuing xpc_connection_create_mach_service calls to the helper's Mach service name.

Monitoring Recommendations

Collect endpoint process telemetry (parent-child lineage, code-signing identity) from macOS hosts and retain it for retrospective hunting.
Monitor /Library/LaunchDaemons/ and /Library/PrivilegedHelperTools/ for the Pearcleaner helper and correlate with installed application version.
Track privilege transitions where a user-installed helper spawns processes as uid 0 shortly after XPC activity.

How to Mitigate CVE-2025-54595

Immediate Actions Required

Upgrade Pearcleaner to version 4.5.2 or later on all macOS endpoints.
Where upgrade is not immediate, uninstall the PearcleanerHelper LaunchDaemon and remove its plist from /Library/LaunchDaemons/.
Audit endpoints for signs of prior exploitation, focusing on root-level processes spawned from the helper.

Patch Information

The fix is delivered in Pearcleaner 4.5.2. Commit 69afadfa adds a CodesignCheck module used by the helper to validate that incoming XPC connections originate from a process signed with the same code-signing certificate chain as the helper itself. See the GitHub Security Advisory GHSA-gr2j-65fh-8pvc and the GitHub Release 4.5.2 for full details.

Workarounds

Remove the privileged helper by unloading and deleting the LaunchDaemon until the application can be updated.
Restrict local interactive logins on multi-user macOS hosts where the helper has been approved.
Do not approve the Pearcleaner privileged helper prompt on shared or high-value systems until 4.5.2 or later is deployed.

bash

# Unload and remove the vulnerable privileged helper
sudo launchctl bootout system /Library/LaunchDaemons/com.alienator88.Pearcleaner.PearcleanerHelper.plist
sudo rm /Library/LaunchDaemons/com.alienator88.Pearcleaner.PearcleanerHelper.plist
sudo rm /Library/PrivilegedHelperTools/com.alienator88.Pearcleaner.PearcleanerHelper

# Verify Pearcleaner version after upgrade
mdls -name kMDItemVersion /Applications/Pearcleaner.app