Cross site scripting on macOS HelpViewer leads to arbitrary file execution and arbitrary file read.
60ac6dfc903acc3a29b78f58ebfa4282a803cce1341a5844a4a5edfbfd88a659
Apple Security Advisory 2017-01-23-2 - macOS 10.12.3 is now available and addresses suffers from code execution and various other security vulnerabilities.
4c40e5dbd35093797941e97f507065322698c00b5f58f1d348c313103335398b