IPVanish VPN for macOS Flaw Enables Privilege Escalation and Code Execution

A high-severity privilege escalation (CVE-PENDING, CVSS 8.8) in the IPVanish macOS VPN helper allows local unprivileged processes to gain root by connecting to an unauthenticated XPC listener and exploiting a logic flaw that skips code-signature checks for non-executable files; an attacker can place a malicious script in a world-writable location, have the helper copy it into a privileged folder, make it executable, and run it (via OpenVPNPath or the --up hook). The report describes the vulnerable components, attack flow, exploitation paths, and prescribes mitigations: strict XPC caller authentication, unconditional signature verification, and strict path whitelisting.