Read the docs
TI-2025-33917 Aliases CVE-2025-54074

Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server

Priority HIGH 69CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malicious MCP server with compatible OAuth authorization server endpoints and trick victims into connecting it, leading to OS command injection in vulnerable clients. This issue has been patched in version 1.5.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02119 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cherry-studio (CherryHQ): 1.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CherryHQcherry-studio1.2.5 to before 1.5.21.5.2Patch availableCNA
  • cherry-studio VendorCherryHQ Affected 1.2.5 to before 1.5.2 Fixed in 1.5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cherry-ai:cherry_studio:*:*:*:*:*:*:*:*1.2.5 to before 1.5.2VulnerableCherryHQ
  • cpe:2.3:a:cherry-ai:cherry_studio:*:*:*:*:*:*:*:* Versions 1.2.5 to before 1.5.2 Vulnerable ·CherryHQ

Remediation

  • Fix · CNA cherry-studio (CherryHQ) Fixed in 1.5.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54074

References

Exploit 1

Patch 1

  • TI-2025-38278 Cherry Studio allows one-click on a specific URL to cause a command to execute CVSS 3.1CRITICAL 9.7
  • TI-2025-34191 Cherry Studio RCE Vulnerability Disclosure CVSS 3.1CRITICAL 9.7
  • TI-2025-33908 Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences