Executive brief
A security vulnerability in the Clash Verge IPC service allows any local user on a computer to gain full administrative (root) control. The service, which manages network settings and system-level drivers, was found to have an unprotected communication channel and a publicly known password. An attacker with basic access to the machine can exploit this to run unauthorized commands with the highest possible system privileges, potentially leading to a total system takeover.
Technical details
The vulnerability is a Local Privilege Escalation (LPE) resulting from a combination of Incorrect Permission Assignment (CWE-732) and Hard-coded Credentials (CWE-798). The IPC socket (e.g., /tmp/verge/verge-mihomo.sock) was explicitly initialized with 0o777 (world-writable) permissions, allowing any local user to interact with the service. Furthermore, the service used a static, hardcoded Shakespearean sonnet as a 'Magic Token' for authentication. Because the service runs with elevated privileges (CAP_NET_ADMIN or root) to manage TUN interfaces, an attacker can send a crafted 'StartClash' command with a malicious 'core_path' to execute arbitrary binaries as root. The issue is fixed in clash-verge-service-ipc v2.3.0 and clash-verge-rev v2.4.5 by restricting socket permissions to 660 and directory permissions to 750.
Affected products
- clash-verge-rev clash-verge-service-ipc < 2.0.26
- clash-verge-rev clash-verge-rev < v2.4.5
Timeline
- 2025-12-25: disclosed: Discovery and private disclosure via GHSA-7gwf-gf64-hgv8
- 2025-12-31: patched: Vulnerability officially patched in upstream repositories
- 2026-02-27: other: CVE reserved by MITRE
- 2026-03-10: advisory: Full technical details released by researcher
- 2026-06-06: other: CVE published to NVD dataset