Executive brief
eObčanka-Identifikace is a macOS identity authentication application used for government digital identity services in Czech Republic. A command injection vulnerability in the custom URL scheme handler allows attackers to execute arbitrary system commands with user privileges if a user clicks a malicious link in a web browser. This could lead to complete compromise of the user's system and access to sensitive identity data.
Technical details
An OS command injection (CWE-78) vulnerability exists in the eObčanka-Identifikace macOS application versions prior to 3.6.0. The application registers a custom URL scheme (czeeopauth://) that passes URL parameters to an AppleScript wrapper using string concatenation without proper sanitization. An attacker can craft a malicious URL containing shell metacharacters (quotes, variable expansion, command separators) to break out of the intended command context and execute arbitrary shell commands in the user's session. The attack requires user interaction (clicking a link) and network access. The vulnerability was mitigated in version 3.6.0 with input validation regex, and permanently fixed in version 3.7.0 by removing the vulnerable AppleScript wrapper entirely.
Affected products
- Digitální a informační agentura eObčanka-Identifikace 3.5.1 and earlier
Timeline
- 2026-08-31: disclosed
- 2026-05-13: patched: Version 3.6.0 with input validation
- 2026-07-17: patched: Version 3.7.0 with permanent fix (script removal)