TUUI EUVD-2025-201459

Exploitation requires the victim to open/view an attacker-crafted Markdown message inside the TUUI desktop client on a version prior to 1.3.4; the malicious payload must be an ECharts code block, which the pre-patch Markdown renderer executed as live JavaScript under a CSP permitting 'unsafe-eval'. Full RCE additionally depends on the app's exposed IPC interface that permits spawning processes - the bridge the injected JS pivots to. Limiting factors: active user interaction is mandatory (UI:A / UI:R - no drive-by against an idle client), and the affected product has a very small user base, so exploitation is inherently targeted rather than opportunistic. The fix (removing ECharts, setting no-echarts, dropping unsafe-eval from the CSP) closes both the script-execution and the delivery path.

This is a genuinely high-impact flaw whose real-world priority is tempered by its narrow deployment footprint and interaction requirement. The vendor CVSS 4.0 vector (8.9) reflects unauthenticated network reach (PR:N) leading to full host compromise (VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H), but crucially requires active user interaction (UI:A) and carries AC:H/AT:P - the attacker depends on the victim opening a crafted Markdown message and on preconditions being met. EPSS is low at 0.43% (62th percentile), the CVE is NOT in CISA KEV, and no public exploit was identified in the provided intelligence (the VulDB entry is an advisory, not exploit code). SSVC-style reading: exploitation=none observed, automatable=no (needs social-engineering delivery to a specific victim), technical impact=total. The signals are internally consistent - a severe technical impact gated behind user interaction and a very small install base - so this reads as a real bug worth patching promptly for TUUI users, not a mass-exploitation emergency. The source diff strongly corroborates the mechanism: the fix removes the ECharts dependency, sets no-echarts on the Markdown renderer, and hardens the CSP from script-src 'self' 'unsafe-eval' to 'self', confirming the arbitrary-JS-in-ECharts-then-IPC-to-process-spawn chain described.

An attacker crafts a Markdown message containing a malicious ECharts code block and gets it in front of a TUUI user (e.g., via an MCP server response, shared chat content, or a document the victim pastes/opens in the client). When the victim views the message, the renderer executes attacker JavaScript, which reaches the exposed IPC process-spawn interface to run arbitrary system commands on the host. No public exploit code was identified at time of analysis, though the vendor commit clearly reveals the vulnerable component and fix.