CVE-2015-7007

macOS < 10.11.1 - Unauthenticated AppleScript Execution Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2015-7007. PoCs published by Metasploit, joev, including Metasploit module exploits/osx/browser/safari_user_assisted_applescript_exec.

AI-analyzed exploit summary This Metasploit module exploits CVE-2015-7007 by tricking a user into pressing cmd-R in Safari, which executes arbitrary AppleScript code. The exploit leverages the applescript:// URL scheme to bypass user confirmation and achieve remote command execution.

Description

Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremoteosx
https://www.exploit-db.com/exploits/38535

This Metasploit module exploits CVE-2015-7007 by tricking a user into pressing cmd-R in Safari, which executes arbitrary AppleScript code. The exploit leverages the applescript:// URL scheme to bypass user confirmation and achieve remote command execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Safari on Mac OS X before 10.11.1
No auth needed
Prerequisites: User interaction (pressing cmd-R) · Gatekeeper disabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC MANUAL
by joev · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb

This Metasploit module exploits a vulnerability in Safari on Mac OS X before 10.11.1 by tricking users into pressing cmd-R to execute arbitrary AppleScript code. It leverages the applescript:// URL scheme to bypass user confirmation and execute a reverse shell payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Safari on Mac OS X before 10.11.1
No auth needed
Prerequisites: User interaction (pressing cmd-R) · Gatekeeper disabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT205375
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/38535/

Scores

EPSS 0.5334
EPSS Percentile 98.8%

Details

Status published
Products (1)
apple/mac_os_x < 10.11.0
Published Oct 23, 2015
Tracked Since Feb 18, 2026