CVE-2025-62686

MEDIUM 6.2CVE-2025-62686 · Published 03/12/2025 · updated 27/10/2026

In short

CVE-2025-62686 is a MEDIUM (CVSS 6.2) vulnerability affecting installation manager (plugin-alliance).
Chance of exploitation in the next 30 days (EPSS): 0.20%, higher than 10.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
installation manager plugin-alliance	`= 1.4.0`	No fix yet

Description

A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 on macOS. Due to the absence of a hardened runtime and a __RESTRICT segment, a local user may exploit the DYLD_INSERT_LIBRARIES environment variable to inject a dynamic library, potentially resulting in code execution with elevated privileges.

References

almightysec.com/plugin-alliance-installationhelper-dylib-injection · Exploit

More vulnerabilities in installation manager

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free