macOS textutil, KeePassXC Flaws Let Attackers Hijack Automation

Key Takeaways

• Security researchers have identified how two commonly used applications, macOS textutil and KeePassXC, can be exploited in automated systems when processing untrusted input.
• The vulnerabilities are not traditional code flaws but stem from incorrect assumptions about how these tools operate within automated pipelines.
• macOS textutil can be coerced into making unexpected network requests (SSRF-like behavior), while KeePassXC can be subjected to resource exhaustion via crafted KDBX files.
• Both issues affect automated environments that process attacker-controlled data, potentially leading to information disclosure or denial-of-service conditions.
• Mitigation strategies involve applying specific command-line flags, sandboxing, input sanitization, network egress filtering, and setting KDF parameter thresholds.

Recent research highlights a critical, yet often overlooked, vulnerability vector in automated systems: the misuse of trusted applications. Cybersecurity experts are cautioning that macOS’s built-in textutil utility and the popular password manager KeePassXC can be weaponized as “attack primitives” when integrated into automated workflows that process data supplied by external, potentially malicious, sources.

These findings, detailed in a report by Cipher Security Labs, do not point to traditional software defects like memory corruption or authentication bypasses. Instead, they expose how well-intentioned features can introduce significant security risks when system designers make incorrect assumptions about trust boundaries and application behavior within automated pipelines.

Automated processes frequently assume that local utilities operate in a safe, offline, and self-contained manner. When these fundamental assumptions prove false, it can pave the way for unintended network connections, resource depletion, and the exposure of sensitive backend infrastructure to external manipulation, often without triggering any security alerts.

Cipher Security Labs researchers uncovered these behaviors during controlled experiments on macOS 26.3 (Build 25D125) and with a local KeePassXC 2.8.0-snapshot build. Their methodology involved repeatable differential command-line workflows, demonstrating the subtle yet impactful nature of these issues.

The core problem, according to the researchers, lies not in the tools themselves being faulty, but in the widespread tendency of engineers and system architects to assume a higher level of isolation and safety than these tools inherently provide. The vulnerability, therefore, resides in the flawed operational models built around these applications, rather than in their intrinsic code.

macOS textutil: Unintended Network Requests

The first vulnerability centers on /usr/bin/textutil, a standard macOS command-line tool commonly used in scripts, continuous integration (CI) jobs, and backend processing to convert or normalize various document formats. Developers typically consider textutil to be an offline-safe utility, assuming it only processes files already present on the system.

However, the research reveals that when textutil is used to convert an HTML file that contains references to remote resources (such as images or linked stylesheets), it silently attempts to fetch these resources over the network. Automated pipelines designed for local document conversion are often unaware of this side effect.

Tests conducted by Cipher Security Labs confirmed this behavior: plain HTML files with no external references generated no outbound network requests. In contrast, HTML files embedding remote image and stylesheet links initiated live HTTP fetches.

In a backend environment where an attacker can supply the HTML input and the conversion worker has network access, this behavior effectively creates a server-side request primitive. This is functionally similar to a Server-Side Request Forgery (SSRF) attack, even though textutil is merely operating as designed by Apple.

Inside the KeePassXC KDF Boundary Problem

The second vulnerability pertains to how KeePassXC, a popular open-source password manager, handles Key Derivation Function (KDF) parameters embedded within its KDBX database files.

Password managers intentionally employ computationally intensive key derivation processes. This slowness is a deliberate security feature, designed to make offline brute-force attacks against master passwords prohibitively expensive. It is not a flaw in the software’s design.

The risk identified by researchers arises when a maliciously crafted KDBX file contains extreme transform-round values within its metadata. Any system attempting to open or process such a file is forced to complete the extensive key derivation work specified by the file before it can proceed.

For instance, a standard KDBX file with approximately 1,000,000 transform rounds took about 0.06 seconds to process in testing. In contrast, a specially crafted file with 353,321,536 rounds extended this processing time to roughly 7.35 seconds, representing a slowdown factor of 119 times.

This demonstrates that the computational cost is driven by metadata, not the file’s size. While a single user manually opening one such database might experience a noticeable delay, automated systems designed to scan, validate, or batch-process numerous KDBX files could face severe CPU resource exhaustion, leading to stalled workers and degraded service availability.

The researchers emphasize that this issue does not compromise passwords or break any cryptographic primitives. The risk is purely one of resource consumption, triggered by attacker-controlled metadata embedded within the KDBX file.

The full technical report, “When Trusted Tools Become Attack Primitives,” is available from Cipher Security Labs.

What You Should Do

• For macOS textutil users in automated pipelines:
  • Apply the -noload flag when converting HTML files to prevent external resource fetching.
  • Run document conversion workers within tightly sandboxed environments with restricted network access.
  • Thoroughly sanitize any remote-bearing HTML content before passing it to textutil.
  • Enforce deny-by-default egress filtering on systems that process untrusted input, limiting outbound network connections.
• For KeePassXC deployments processing KDBX files from untrusted sources:
  • Implement maximum thresholds for KDF parameters to prevent excessive computational demands.
  • Configure KeePassXC to display explicit warnings or require user confirmation before opening files with unusually high KDF values.
  • Enforce bounded processing times per file in automated systems to prevent denial-of-service scenarios.
  • Isolate untrusted file handling processes from critical operational paths to contain potential resource exhaustion.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.