CVE-2025-61929 is a critical remote code execution vulnerability affecting Cherry Studio, a desktop client for LLM providers. The vulnerability arises from improper handling of the custom cherrystudio:// protocol, specifically when processing base64-encoded configuration data within MCP installation URLs, leading to direct command execution. With a CVSS score of 9.6 (CRITICAL), this flaw allows unauthenticated attackers to achieve full compromise of a user's system through a low-complexity attack requiring user interaction, such as clicking a malicious link. There are currently no known patches, and while no public exploit code or active exploitation has been confirmed, the vulnerability has garnered community discussion, highlighting the urgent need for mitigation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.6.4CPE matchmatch criteria | cpe:2.3:a:cherry-ai:cherry_studio:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.