CVE-2025-9474: Mihomo Party Socket sysproxy.ts enableSysProxy temp file

Severity: medium (CVSS 4.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-26 · updated 2026-06-17
Weakness: CWE-377

Description

A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with insecure permissions. The attack requires a local approach. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit is now public and may be used.

Affected products

Mihomo Party: 1.8.0, 1.8.1

References

https://github.com/SwayZGl1tZyyy/n-days/blob/main/mihomo-party/README.md
https://github.com/SwayZGl1tZyyy/n-days/blob/main/mihomo-party/README.md#proof-of-concept-1
https://vuldb.com/?ctiid.321343
https://vuldb.com/?id.321343
https://vuldb.com/?submit.634656

Get alerted when CVE-2025-9474 or the next vulnerability affects your stack