# CVE-2021-40531

![Exploit Demo](

> This proof-of-concept in action.

[Sketch]( is a popular UI/UX design app for macOS. This
post covers a vulnerability in Sketch that I discovered back in July,
CVE-2021-40531. In its simplest form, it is a macOS quarantine bypass, but in
context it can be used for remote code execution.

For more details, see my [blog post](
for a complete writeup.

## Notes

If you are testing this proof-of-concept locally, be aware that `feed.rss`
expects your web server to be running on port 8080.