CVE-2025-69604: Shirt-Pocket Superduper!

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.

Affected products

• Shirt-Pocket Superduper!: before 3.12 (fixed in 3.12)

Published 2026-01-29. Last modified 2026-07-05.