A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS. The service accepts unauthenticated XPC connections and executes input via system(), which may allow a local user to execute arbitrary commands with root privileges.
References
| Link | Resource |
|---|---|
| https://almightysec.com/plugin-alliance-helpertool-xpc-service-local-privilege-escalation/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
18 Dec 2025, 20:56
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Plugin-alliance
Apple macos Apple Plugin-alliance installation Manager |
|
| CPE | cpe:2.3:a:plugin-alliance:installation_manager:1.4.0:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* |
|
| References | () https://almightysec.com/plugin-alliance-helpertool-xpc-service-local-privilege-escalation/ - Exploit, Third Party Advisory |
03 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-03 17:15
Updated : 2025-12-18 20:56
NVD link : CVE-2025-55076
Mitre link : CVE-2025-55076
CVE.ORG link : CVE-2025-55076
JSON object : View
Products Affected
apple
- macos
plugin-alliance
- installation_manager
CWE
CWE-269
Improper Privilege Management