CVE-2025-50505

Clash Verge Rev (versions through 2.2.3 ) is vulnerable to Local Privilege Escalation (LPE) and Remote Code Execution (RCE) due to an unauthenticated HTTP API endpoint (/start_clash) in the clash-verge-service component. The service, which runs with elevated privileges (root or SYSTEM), allows at...