CVE-2026-59111: Ministry Of The Interior Mvčr Eobčanka-Identifikace

Critical severity, CVSS 9.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.

Affected products

• Ministry Of The Interior Mvčr Eobčanka-Identifikace: up to and including 3.5.1

Published 2026-08-31. Last modified 2026-09-01.