CVE-2023-0976

CVE-2023-0976 is a command injection vulnerability affecting Trellix Agent (TA) for macOS versions prior to 5.7.9. This flaw allows a local attacker to place an arbitrary malicious file into the /Library/Trellix/Agent/bin/ folder, which is then executed when the TA deployment feature is run. With a CVSS score of 7.8 (HIGH), the vulnerability has a low attack complexity and requires user interaction, but can lead to high impacts on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.