CVE-2021-40531: Sketch

Critical severity, CVSS 9.8. EPSS: 32.8% chance of exploitation in the next 30 days.

Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app.

Affected products

• Sketch Sketch: before 75 (fixed in 75)

Published 2021-09-06. Last modified 2026-06-17.