CVE-2026-39862: Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link
Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhost:29070 URLs. The arguments query parameter flows unsanitized from URL parsing through to /bin/bash -c execution, allowing an attacker to execute arbitrary commands on a developer's macOS workstation. Any developer with Tophat installed is vulnerable. For previously trusted build hosts, no confirmation dialog appears. Attacker commands run with the user's permissions. This vulnerability is fixed in 2.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tophatto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39862?
CVE-2026-39862 has a critical severity rating due to its potential for remote code execution.
How do I fix CVE-2026-39862?
To fix CVE-2026-39862, upgrade to Tophat version 2.5.1 or later.
What type of vulnerability is CVE-2026-39862?
CVE-2026-39862 is a command injection vulnerability that can allow remote code execution.
Which versions of Tophat are affected by CVE-2026-39862?
Versions of Tophat prior to 2.5.1 are affected by CVE-2026-39862.
How does CVE-2026-39862 exploit software through URLs?
CVE-2026-39862 exploits the application by passing crafted tophat:// or http://localhost:29070 URLs that include unsanitized arguments.