Researchers have found a flaw in Apple’s macOS Finder component that could allow attackers to dupe users into running arbitrary commands on their devices.