What is the CVSS score of CVE-2025-61929?

CVE-2025-61929 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2025-61929?

Yes, a public proof-of-concept exploit is available for CVE-2025-61929. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2025-61929?

Within 24 hours, inventory every endpoint where Cherry Studio is installed (query EDR/asset management for the process and binary name), warn those users in writing not to click cherrystudio:// links from email, chat or the web, and block or filter the cherrystudio:// URI scheme at email and web gateways; where business operations permit, deregister the handler on Windows via the registry (Computer\HKEY_CLASSES_ROOT\cherrystudio and the per-user HKCU Software\Classes\cherrystudio key) and on macOS by removing the URL scheme association in Launch Services, or temporarily uninstall the application on the highest-risk machines. Within 7 days, open a case with the Cherry Studio vendor to obtain a fix timeline and interim hardening guidance, deploy EDR detections for Cherry Studio spawning command interpreters or scripts (cmd.exe, powershell.exe, /bin/sh, curl, wget) and for base64-decode-then-execute behaviour, confirm least-privilege local accounts on affected endpoints so any execution is not elevated, and hunt telemetry for prior cherrystudio:// invocations or unexpected child processes to establish whether exploitation has already occurred. Within 30 days, deploy the vendor-released patch as soon as it is issued and validated, restore the protocol handler only after confirming the fix, add Cherry Studio to the standard vulnerability-management and software-approval process with a review of other third-party desktop applications that register custom URI handlers, and refresh security-awareness training using this link-click scenario as a worked example.

Cherry Studio CVE-2025-61929

CRITICAL

Code Injection (CWE-94)

2025-10-10 security-advisories@github.com

RCE Code Injection Cherry Studio

9.6

CVSS 3.1 · Vendor: github

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Lure victim to malicious page
Delivery

Deliver crafted cherrystudio://mcp URL
Exploit

User clicks button/link
Install

App decodes base64 MCP config
C2

Install pop-up click approves action
Execute

Embedded command executes on host
Impact

Attacker gains code execution

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires that the victim has Cherry Studio installed and that the cherrystudio:// custom URL-scheme handler is registered on the OS (the default behavior after installation). Exploitation is triggered specifically through the MCP installation flow: a cherrystudio://mcp URL whose base64-encoded configuration contains a command that handleMcpProtocolUrl (src/main/services/ProtocolClient.ts and src/main/services/urlschema/mcp-install.ts) decodes and executes directly. The key LIMITING factor is required user interaction (CVSS UI:R): the victim must click the malicious link/button and then click through the install pop-up, which the app mis-treats as intentional approval - so the attack depends on social engineering rather than being fully automatic. No authentication is required (PR:N). Because no patched version exists, there is no version-based mitigation; defenders must rely on user awareness and blocking the custom protocol.
Impact	Signals are largely consistent and point to a genuine high-priority issue for Cherry Studio users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes network-reachable, low-complexity, unauthenticated code injection that requires only a single user click and escapes the application's scope to execute OS commands (CWE-94). This is reinforced by a publicly available exploit (POC=YES) and the vendor/GitHub advisory confirming the flaw, plus the critical aggravating factor that no patched version exists at publication - defenders cannot simply remediate by upgrading. The one tempering signal is EPSS: 0.47% (39th percentile) indicates low modeled probability of broad opportunistic exploitation in the near term, and the CVE is NOT on CISA KEV, so there is no confirmation of active in-the-wild use. This is expected for a client-side, user-interaction-dependent desktop bug (each victim must be lured into clicking) rather than a mass-scannable server flaw, so the low EPSS does not negate the severity - it reflects a social-engineering delivery model rather than wormable mass exploitation. Net: a real, actionable priority for any Cherry Studio deployment given working POC and no patch, but exploitation is targeted/lure-driven rather than automated at internet scale.
Exploit ScenarioDerived	An attacker hosts a web page (or sends a message/email) containing a button or link encoding a malicious base64 MCP configuration in a cherrystudio://mcp URL. When a Cherry Studio user clicks it, the app launches an install pop-up showing seemingly normal content; because the user's single click is treated as approval, the embedded command is executed directly on the victim's machine. A public proof-of-concept exists, and the AV:N/AC:L/UI:R profile means the only barrier is convincing the user to click once.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

Remote code execution in Cherry Studio allows unauthenticated attackers to run arbitrary commands on a victim's system when the victim clicks a crafted cherrystudio://mcp link. The custom protocol handler decodes a base64-encoded configuration and directly executes the command it contains, and publicly available exploit code exists. Although EPSS is low (0.47%, percentile 39%), the CVSS base score is 9.6 and no vendor-released patch was identified at the time of analysis, so users must rely on blocking the protocol and user awareness.

RemediationAI

No vendor-released patch identified at time of analysis. The most effective mitigation is to block or remove the cherrystudio:// custom protocol handler at the operating-system level (for example, by deleting the registry entry on Windows, unregistering the LaunchServices entry on macOS, or removing the xdg desktop file on Linux), which prevents the vulnerable handleMcpProtocolUrl path from being invoked; however, this also breaks legitimate MCP installation links and may require manual re-registration. Additionally, educate users not to click unsolicited cherrystudio:// links or confirm unexpected MCP installation pop-ups, but note that social engineering can bypass training. Monitor the vendor advisory at https://github.com/CherryHQ/cherry-studio/security/advisories/GHSA-hh6w-rmjc-26f6 for a patched release. As a compensating control, consider application allowlisting or endpoint detection rules that flag command execution originating from Cherry Studio's protocol handler.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the custom URL-scheme handler cherrystudio://, registered by default when Cherry Studio is installed. Specifically, the functions handleMcpProtocolUrl in src/main/services/ProtocolClient.ts and src/main/services/urlschema/mcp-install.ts process MCP installation URLs by base64-decoding configuration data and then executing the command within it without sufficient validation. This falls under CWE-94 (Improper Control of Generation of Code / Code Injection) and affects all versions per the CPE wildcard cpe:2.3:a:cherry-ai:cherry_studio:*:*:*:*:*:*:*:*. Exploitation requires no authentication (PR:N) but does require user interaction (UI:R): the victim must click a malicious link and then confirm the install pop-up, which the application erroneously treats as intentional approval, making social engineering the primary attack vector.

Know when Cherry Studio gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI 9.6 CRITICAL

Network-delivered malicious URL with no authentication (PR:N, AV:N), low complexity (AC:L), one required click (UI:R), and command execution escaping the app to the OS (S:C) yields full C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called cherrystudio://. When handling the MCP installation URL, it parses the base64-encoded configuration data and directly executes the command within it. In the files src/main/services/ProtocolClient.ts and src/main/services/urlschema/mcp-install.ts, when receiving a URL of the cherrystudio://mcp type, the handleMcpProtocolUrl function is called for processing. If an attacker crafts malicious content and posts it on a website or elsewhere (there are many exploitation methods, such as creating a malicious website with a button containing this malicious content), when the user clicks it, since the pop-up window contains normal content, the direct click is considered a scene action, and the malicious command is directly triggered, leading to the user being compromised. As of time of publication, no known patched versions exist.

Executive ViewAI

Why It Matters

Cherry Studio, a desktop AI assistant used by individual employees, can be made to execute arbitrary commands on a user's workstation when that user clicks a crafted cherrystudio://mcp link, and publicly available exploit code exists. Because no vendor-released patch was identified at time of analysis, the only defenses are removing the protocol handler and stopping users from clicking malicious links, leaving affected endpoints open to full compromise and possible follow-on movement into corporate systems. Leadership should treat this as a concentrated endpoint risk affecting the specific teams that have installed Cherry Studio, not as an enterprise-wide service outage.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: block or filter the cherrystudio:// URI scheme at email and web gateways; deregister or disable the custom protocol handler on affected endpoints (Windows registry Classes\cherrystudio keys, macOS Launch Services URL scheme association); temporarily uninstall Cherry Studio on high-risk machines where it is not business-critical; restrict users to non-privileged local accounts so command execution cannot escalate; deploy EDR detections for Cherry Studio spawning script interpreters or shells and for base64-decode-and-execute behaviour; and issue user guidance prohibiting clicks on cherrystudio:// links until a patched version is available.

Threat Intelligence Overview

EPSS Score

0.5%

Top 61% exploitable

Prevalence

Medium

popular open-source LLM desktop client, developer/enthusiast footprint not enterprise-wide

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +48

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.