Skip to content
OpenAdvisories

Vendor

CherryHQ

7 known vulnerabilities.

Products

cherry-studio 7
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-40501

    Cherry Studio RCE via SearchService nodeIntegration Misconfiguration

    Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScript through controlled search provider c…

    CherryHQ cherry-studio
  • High 7.7
    CVE-2025-54074

    Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server

    Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malici…

    CherryHQ cherry-studio
  • High 8.0
    CVE-2025-54063

    Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling

    Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or …

    CherryHQ cherry-studio