MTW CleanShot X: Insecure deserialization of .cleanshot files
Summary
CleanShot X for macOS insecurely deserializes untrusted data embedded in .cleanshot project files (editable screenshot annotations). An attacker who crafts a malicious file can execute arbitrary code in the context of the current user when the victim opens it. Users who have never opened a .cleanshot file from an untrusted source are not affected.
Affected
- MTW CleanShot X 4.0.0 to before 4.5.2
- MTW CleanShot X 4.6.0 to before 4.6.3
- MTW CleanShot X 4.7.0 to before 4.7.8
- MTW CleanShot X 4.8.0 to before 4.8.10
- Versions outside these ranges: unverified, check with the vendor
Fixed in
- 4.5.2
- 4.6.3
- 4.7.8
- 4.8.10
Workaround
- No vendor workaround known.
- Do not open .cleanshot files from untrusted senders until the app is updated.
Exploitation
- Exploited in the wild: no evidence found.
- Public proof of concept: none found.
- CISA KEV: not listed according to available sources (not verified directly).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check Macs for CleanShot X and confirm the version is 4.5.2, 4.6.3, 4.7.8, 4.8.10 or later.
- Update through the normal channel.
- Advise users not to open .cleanshot files from unknown senders, for example from email, chat or downloads.
- Prioritise design, marketing and Mac-heavy teams that use CleanShot's sharing features.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska advisory CVE-2026-16477 cert.pl
- CleanShot X changelog cleanshot.com
- VulDB entry 425316 vuldb.com
- Strix CVE summary www.strix.ai
- GitHub Advisory GHSA-53fh-qcq6-xwhv github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:10.
Original description (NVD)
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10
NVD references (2)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.