Cherryhq
Monthly
Remote code execution in Cherry Studio 1.2.2 through 1.9.12 lets attackers who control search-provider content run arbitrary Node.js code because the SearchService loads that content into an Electron BrowserWindow with nodeIntegration enabled and contextIsolation disabled. An attacker controlling a search engine provider, search result page, or provider settings page can execute JavaScript with full Node.js privileges under the OS account running the app. Publicly available exploit code exists (VulnCheck/Mundi-Xu gist) and a vendor patch (commit 1518530) is available; the flaw is not currently listed in CISA KEV.
Authorization bypass in CherryHQ Cherry Studio up to version 1.9.7 allows authenticated remote attackers to cross user/agent memory isolation boundaries by manipulating memory content to produce SHA-256 hash collisions in the MemoryService deduplication logic. The vulnerable CherryIN Preload API component computed memory hashes solely from content, without scoping them to userId or agentId, enabling crafted inputs to match records belonging to other users. A public exploit exists per GitHub issue #15411, and a vendor patch is available via PR #15413; the vendor notes the memory feature is slated for removal in v2.
Cherry Studio's MCP OAuth Local Callback Server, in all versions up to 1.9.6, accepts OAuth authorization code callbacks without validating the OAuth `state` parameter, enabling authorization code injection attacks. The PR diff confirms that `src/main/services/mcp/oauth/callback.ts` processed any inbound `code` value without checking a bound state token, allowing a network-positioned attacker to substitute a malicious authorization code during an active OAuth flow. A public exploit has been disclosed via GitHub issue #15372; no confirmed patched release exists - only an unmerged fix PR (#15388) - and no active exploitation has been confirmed (not in CISA KEV).
Remote code execution in Cherry Studio 1.2.2 through 1.9.12 lets attackers who control search-provider content run arbitrary Node.js code because the SearchService loads that content into an Electron BrowserWindow with nodeIntegration enabled and contextIsolation disabled. An attacker controlling a search engine provider, search result page, or provider settings page can execute JavaScript with full Node.js privileges under the OS account running the app. Publicly available exploit code exists (VulnCheck/Mundi-Xu gist) and a vendor patch (commit 1518530) is available; the flaw is not currently listed in CISA KEV.
Authorization bypass in CherryHQ Cherry Studio up to version 1.9.7 allows authenticated remote attackers to cross user/agent memory isolation boundaries by manipulating memory content to produce SHA-256 hash collisions in the MemoryService deduplication logic. The vulnerable CherryIN Preload API component computed memory hashes solely from content, without scoping them to userId or agentId, enabling crafted inputs to match records belonging to other users. A public exploit exists per GitHub issue #15411, and a vendor patch is available via PR #15413; the vendor notes the memory feature is slated for removal in v2.
Cherry Studio's MCP OAuth Local Callback Server, in all versions up to 1.9.6, accepts OAuth authorization code callbacks without validating the OAuth `state` parameter, enabling authorization code injection attacks. The PR diff confirms that `src/main/services/mcp/oauth/callback.ts` processed any inbound `code` value without checking a bound state token, allowing a network-positioned attacker to substitute a malicious authorization code during an active OAuth flow. A public exploit has been disclosed via GitHub issue #15372; no confirmed patched release exists - only an unmerged fix PR (#15388) - and no active exploitation has been confirmed (not in CISA KEV).