PT-2025-32563

CVE-2025-54063

Published

2025-08-11

Updated

2025-12-02

Description by

CVSS 3.1

9.6

Critical

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cherry Studio versions 1.4.8 through 1.5.0

Description: Cherry Studio is a desktop client supporting multiple LLM providers. A one-click remote code execution issue exists due to improper custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL. Clicking the exploit link in a browser triggers the app’s custom URL handler, resulting in remote code execution on the victim’s machine.

Recommendations: Update to version 1.5.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jackfromeast

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers