Researchers are warning that widely trusted local tools such as macOS’s textutil and KeePassXC can pose unexpected security risks when used within automated workflows.
The issue is not traditional vulnerabilities such as memory corruption or code execution, but how normal features behave when exposed to attacker-controlled input.
Many engineering teams treat built-in utilities as safe and predictable. These tools often run in scripts, CI pipelines, backend processors, and data import systems.
Because they are local and mature, they are assumed to be offline, controlled, and low risk. However, this assumption can break down when untrusted input is introduced.
The research highlights a key idea: a tool can work exactly as designed and still become security-relevant in the wrong context.
macOS textutil and hidden network activity
According to the report, macOS textutil is commonly used to convert files, such as turning HTML into plain text. It is often assumed to operate entirely offline.
But HTML is not just static content it can include references to external resources like images and stylesheets.
Tests showed that when Textutil processes HTML containing remote links, it may automatically fetch those resources over the network.
For example, an HTML file with an external image caused the system to send HTTP requests during conversion, while a simple HTML file without remote references did not.
This creates a potential Server-Side Request Forgery (SSRF)-style risk. If an attacker can control the HTML input and the system has network access, the conversion process can trigger outbound requests from trusted infrastructure.
In a real-world scenario, a backend service that converts uploaded HTML files could unknowingly be used to probe internal services or send requests to restricted endpoints.
A simple mitigation is using the -noload flag in textutil, which prevents loading external resources. Additional protections include sandboxing conversion processes and restricting outbound network access.
KeePassXC and attacker-controlled CPU cost
KeePassXC, a popular password manager, uses key derivation functions (KDF) to make password cracking more difficult. This process is intentionally computationally expensive.
However, the research shows that KDF parameters stored inside a database file (KDBX) can be manipulated.
A crafted database with extremely high KDF settings significantly increased processing time from around 0.06 seconds to over 7 seconds in testing, a slowdown of more than 100 times.
This is not a cryptographic flaw. Instead, it is a resource consumption issue. If such files are processed automatically such as in batch validation or security scanning they could degrade performance or cause denial-of-service conditions.
For example, an automated system that scans multiple password databases could be slowed dramatically if it encounters several crafted files with extreme KDF values.
Recommended safeguards include setting limits on acceptable KDF parameters, adding warnings for unusually high values, and enforcing execution time or resource caps.
Both cases follow the same pattern:
- The tool behaves correctly.
- The input is attacker-controlled.
- The tool runs inside an automated, trusted system.
- Security impact emerges at the integration level.
In one case, input triggers network activity. In the other, it drives CPU usage. Neither is a classic vulnerability, but both become powerful primitives when placed inside automation pipelines.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
