10287 matches found
CVE-2025-54382 Cherry Studio RCE Vulnerability Disclosure
Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution RCE vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirecti...
CVE-2025-54382 Cherry Studio RCE Vulnerability Disclosure
Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution RCE vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirecti...
CVE-2025-54074 Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server
Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malicious MCP server with compatible OAuth...
CVE-2025-54074 Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server
Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malicious MCP server with compatible OAuth...
CVE-2025-54074
CVE-2025-54074 affects Cherry Studio desktop client, versions 1.2.5–1.5.1, which are vulnerable to OS command injection when connecting to a malicious MCP server over HTTP Streamable mode. The underlying issue arises during the OAuth-enabled connection process, allowing an attacker-controlled MCP...
CVE-2025-54074 Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server
Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malicious MCP server with compatible OAuth...
Studio 3T 安全漏洞
Studio 3T is a native cross-platform MongoDB management tool open-sourced by Studio 3T. A security vulnerability exists in Studio 3T 2025.1.0 and earlier versions, which stems from improper handling of a specially crafted payload by the childprocess module and could lead to arbitrary code executi...
Cytel Studio 安全漏洞
Cytel Studio is a data processing software from Cytel Corporation. A security vulnerability exists in Cytel Studio 9.0 and prior versions that originates from a stack buffer overflow when processing .CY3 files, which could lead to the execution of arbitrary code...
PT-2025-33084 · Cytel · Cytel Studio
Name of the Vulnerable Software and Affected Versions: Cytel Studio versions 9.0 and earlier Description: Cytel Studio version 9.0 and earlier is susceptible to a stack-based buffer overflow due to improper handling of a malformed .CY3 file. The issue arises when the application copies...
CVE-2025-52385
An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the childprocess module...
CVE-2025-52385
An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the childprocess module...
PT-2025-32990 · Unknown · Cherry-Studio
Name of the Vulnerable Software and Affected Versions: Cherry Studio version 1.5.1 Description: Cherry Studio is a desktop client that supports multiple LLM providers. A remote code execution RCE vulnerability exists when connecting to streamableHttp MCP servers. The issue stems from the server’s...
CVE-2025-52385
CVE-2025-52385 affects Studio 3T up to 2025.1.0, with a remote code execution vulnerability via a crafted payload to the child_process module in IntelliShell. The issue arises from improper handling allowing an attacker to run arbitrary code; CVSSv3.1 is reported as 9.8 (CRITICAL) with network at...
PT-2025-32989 · Unknown · Cherry-Studio
Name of the Vulnerable Software and Affected Versions: Cherry Studio versions 1.2.5 through 1.5.1 Description: Cherry Studio is vulnerable to OS Command Injection when connecting to a malicious MCP server in HTTP Streamable mode. Attackers can establish a malicious MCP server with compatible OAut...
Cherry Studio 操作系统命令注入漏洞
Cherry Studio is a multi-model AI assistant from China Thousand Comets Cherry Studio. An OS command injection vulnerability exists in Cherry Studio versions 1.2.5 through 1.5.1, which stems from an OS command injection when connecting to a malicious MCP server...
PT-2025-33035 · Studio 3T · Studio 3T
Name of the Vulnerable Software and Affected Versions: Studio 3T versions prior to 2025.1.1 Description: An issue allows a remote attacker to execute arbitrary code via a crafted payload to the child process module. Recommendations: Update to version 2025.1.1 or later...
Cherry Studio 操作系统命令注入漏洞
Cherry Studio is a multi-model AI assistant from China Thousand Comets Cherry Studio. An operating system command injection vulnerability exists in Cherry Studio version 1.5.1, which stems from a streamableHttp MCP server connection that does not properly clean up the URL, which could lead to...
CVE-2025-53773
Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...
