TI-2025-38278 CVE-2025-61929
Cherry Studio allows one-click on a specific URL to cause a command to execute
Priority HIGH 82
Cherry Studio is a desktop client that supports for multiple LLM providers.
CherryHQ
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
CherryHQ records in CISA KEVNo CherryHQ vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2025-34191 CVE-2025-54382
Cherry Studio RCE Vulnerability Disclosure
Priority HIGH 76
Cherry Studio is a desktop client that supports for multiple LLM providers.
TI-2025-33908 CVE-2025-54063
Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling
Priority HIGH 76
Cherry Studio is a desktop client that supports for multiple LLM providers.
TI-2026-29251 CVE-2026-40501 · GHSA-5c46-rj6r-wvm8
Cherry Studio RCE via SearchService nodeIntegration Misconfiguration
Priority HIGH 72
Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScri…
TI-2025-33917 CVE-2025-54074
Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server
Priority HIGH 69
Cherry Studio is a desktop client that supports for multiple LLM providers.
TI-2026-11449 CVE-2026-13524 · GHSA-9c5h-h4mj-p5ch
CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization
Priority MEDIUM 61
A security vulnerability has been detected in CherryHQ cherry-studio up to 1.9.6.
TI-2026-11459 CVE-2026-13534 · GHSA-qwwm-4xhq-q4m4
CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization
Priority MEDIUM 45
A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7.