PT-2025-33035 · Studio 3T · Studio 3T

Name of the Vulnerable Software and Affected Versions: Studio 3T versions prior to 2025.1.1 Description: An issue allows a remote attacker to execute arbitrary code via a crafted payload to the child process module. Recommendations: Update to version 2025.1.1 or later...

CVE-2025-52385

A critical Remote Code Execution (RCE) vulnerability exists in Studio 3T version 2025.1.0 and earlier . The flaw resides in the IntelliShell component, where improper handling of a crafted JavaScript payload by the child_process module allows a remote attacker to execute arbitrary operating syste...

CVE-2011-10015: Stack-based Buffer Overflow

Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer 256 bytes without proper bounds checking. Exploitation allows...

PT-2025-32990

Name of the Vulnerable Software and Affected Versions Cherry Studio versions prior to 1.5.2 Description Cherry Studio is a desktop client that supports multiple LLM providers. A remote code execution RCE issue exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The...

Studio 3T security vulnerabilities

Studio 3T is a native cross-platform MongoDB management tool open-sourced by Studio 3T. A security vulnerability exists in Studio 3T 2025.1.0 and earlier versions, which stems from improper handling of a specially crafted payload by the childprocess module and could lead to arbitrary code executi...

Cherry Studio operating system command injection vulnerability

Cherry Studio is a multi-model AI assistant from China Thousand Comets Cherry Studio. An OS command injection vulnerability exists in Cherry Studio versions 1.2.5 through 1.5.1, which stems from an OS command injection when connecting to a malicious MCP server...

Cherry Studio operating system command injection vulnerability

Cherry Studio is a multi-model AI assistant from China Thousand Comets Cherry Studio. An operating system command injection vulnerability exists in Cherry Studio version 1.5.1, which stems from a streamableHttp MCP server connection that does not properly clean up the URL, which could lead to...

CVE-2025-54074: Improper Neutralization of Special Elements used in an OS Command

Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malicious MCP server with compatible OAuth...

CVE-2025-52385: Improper Control of Generation of Code

An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the childprocess module...

Cytel Studio security vulnerabilities

Cytel Studio is a data processing software from Cytel Corporation. A security vulnerability exists in Cytel Studio 9.0 and prior versions that originates from a stack buffer overflow when processing .CY3 files, which could lead to the execution of arbitrary code...

CVE-2025-52385

An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the childprocess module...

CVE-2025-52385

An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the childprocess module...

CVE-2025-52385

An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the childprocess module...

PT-2025-32989

Name of the Vulnerable Software and Affected Versions: Cherry Studio versions 1.2.5 through 1.5.1 Description: Cherry Studio is vulnerable to OS Command Injection when connecting to a malicious MCP server in HTTP Streamable mode. Attackers can establish a malicious MCP server with compatible OAut...

CVE-2025-53773

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

CVE-2025-53773

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

CVE-2025-53773 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

...

CVE-2025-53773 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

...

CVE-2025-53773

CVE-2025-53773 describes a command-injection-based remote code execution risk in GitHub Copilot and Visual Studio. The root cause is improper neutralization of elements in prompts/config that Copilot can read and act on, potentially allowing an attacker to cause Copilot to modify project configur...

GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...