Vulnerabilities

TI-2026-29251 CVE-2026-40501 · GHSA-5c46-rj6r-wvm8

Cherry Studio RCE via SearchService nodeIntegration Misconfiguration

HIGH 72

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScri…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00805 Published 2026-07-15 No fix listed CWE-829

TI-2026-11459 CVE-2026-13534 · GHSA-qwwm-4xhq-q4m4

CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization

MEDIUM 45

A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00325 Published 2026-06-29 No fix listed CWE-285

TI-2026-11449 CVE-2026-13524 · GHSA-9c5h-h4mj-p5ch

CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization

MEDIUM 61

A security vulnerability has been detected in CherryHQ cherry-studio up to 1.9.6.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00424 Published 2026-06-29 No fix listed CWE-266

TI-2025-38278 CVE-2025-61929

Cherry Studio allows one-click on a specific URL to cause a command to execute

HIGH 82

Cherry Studio is a desktop client that supports for multiple LLM providers.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00471 Published 2025-10-10 No fix listed CWE-94

TI-2025-34191 CVE-2025-54382

Cherry Studio RCE Vulnerability Disclosure

HIGH 76

Cherry Studio is a desktop client that supports for multiple LLM providers.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.08302 Published 2025-08-13 No fix listed CWE-78

TI-2025-33917 CVE-2025-54074

Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server

HIGH 69

Cherry Studio is a desktop client that supports for multiple LLM providers.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.02119 Published 2025-08-13 Fixed in 1.5.2 CWE-78

TI-2025-33908 CVE-2025-54063

Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling

HIGH 76

Cherry Studio is a desktop client that supports for multiple LLM providers.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00831 Published 2025-08-11 Fixed in 1.5.1 CWE-94

Vulnerabilities

Filters

Cherry Studio RCE via SearchService nodeIntegration Misconfiguration

CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization

CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization

Cherry Studio allows one-click on a specific URL to cause a command to execute

Cherry Studio RCE Vulnerability Disclosure

Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server

Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling