LiveActive security incident?Get immediate response
CVE Record

CVE-2021-30975: This issue was addressed by disabling execution of JavaScript when viewing a scripting dictionary.

This issue was addressed by disabling execution of JavaScript when viewing a scripting dictionary. This issue is fixed in macOS Monterey 12.1, Security Update 2021-008 Catalina, macOS Big Sur 11.6.2. A malicious OSAX scripting addition may bypass Gatekeeper checks and circumvent sandbox restrictions.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-30975 is a macOS flaw where a malicious OSAX scripting addition could bypass Gatekeeper checks and sandbox restrictions. Apple fixed it by disabling JavaScript execution when viewing a scripting dictionary. The main concern is older Macs that have not received Monterey 12.1, Big Sur 11.6.2, or Security Update 2021-008 Catalina.

Executive priority

Address through normal macOS security patch governance unless critical business systems remain below the fixed releases. This is not sourced as actively exploited, but it weakens Apple platform protections that executives typically rely on for endpoint risk reduction.

Technical view

The issue affects macOS scripting dictionary handling. Apple states JavaScript execution in that context allowed a malicious OSAX scripting addition to bypass Gatekeeper and circumvent sandbox restrictions. The provided sources do not include CVSS, CWE, exploit details, prerequisites, or affected-version granularity beyond the fixed macOS releases.

Likely exposure

Exposure is likely limited to macOS endpoints below the fixed releases named by Apple. Organizations with unmanaged Macs, delayed patching, or legacy Catalina and Big Sur systems have the clearest exposure. The sources do not identify non-Apple products or exact vulnerable version ranges.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Apple describes a malicious OSAX scripting addition bypassing platform controls, but the public sources provided do not give exploit maturity, prevalence, or confirmed in-the-wild use.

Researcher notes

Public detail is sparse. Analysis should stay anchored to Apple’s statement: malicious OSAX scripting addition, Gatekeeper bypass, sandbox restriction circumvention, and JavaScript disabled during scripting dictionary viewing. Do not infer remote exploitation, affected build ranges, or exploit availability from the provided sources.

Mitigation direction

  • Update macOS Monterey systems to 12.1 or later.
  • Update Big Sur systems to 11.6.2 or later.
  • Apply Security Update 2021-008 on Catalina systems.
  • Check Apple guidance for any environment-specific deployment notes.
  • Prioritize unmanaged or internet-exposed user endpoints for patch verification.

Validation and detection

  • Inventory macOS versions across managed and unmanaged endpoints.
  • Confirm Monterey endpoints report version 12.1 or later.
  • Confirm Big Sur endpoints report version 11.6.2 or later.
  • Confirm Catalina endpoints have Security Update 2021-008 installed.
  • Review endpoint management compliance for missing Apple security updates.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-30975 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
ApplemacOSunspecifiedListed
ApplemacOSunspecifiedListed
ApplemacOSunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.