CVE-2018-10406

Yelp OSXCollector Improper Certificate Validation

7.8 HighFix available

An issue was discovered in Yelp OSXCollector. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.84%Up 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 7.8

Record: CVE-2018-10406
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-295
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-10406
Updated: 2026-11-02

EUVDEUVD-2018-0110 No score

Record: EUVD-2018-0110
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g3cc-pvjj-9xq9 8.4

Yelp OSXCollector Improper Certificate Validation

Record: GHSA-g3cc-pvjj-9xq9
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-295
Updated: 2026-11-02

OSV 7.8

Record: CVE-2018-10406
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-g3cc-pvjj-9xq9 8.4

Yelp OSXCollector Improper Certificate Validation

Record: GHSA-g3cc-pvjj-9xq9
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-295
Updated: 2026-11-02

OSVPYSEC-2018-95 No score

Record: PYSEC-2018-95
Updated: 2026-11-02

Affected products

yelp osxcollector

Affected packages

Affected packages
Package	Affected	Fixed
`osxcollector` PyPI	before 1.10	1.10
`osxcollector` PyPI	before 1.10, plus listed versions 1.71.8	1.10

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-10406 is a high vulnerability (CVSS 7.8) in Yelp Osxcollector, published June 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in osxcollector 1.10.