Advisories · Technology

CherryHQ cherry-studio.

Every CVE that names CherryHQ cherry-studio among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-40501 CVE record

CVSS 8.6 High

Cherry Studio RCE via SearchService nodeIntegration Misconfiguration
- CherryHQ cherry-studio
- CWE-829
Not analysed yet 15 Jul 2026
CVE-2026-13534 CVE record

CVSS 2.3 Low

CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization
- CherryHQ cherry-studio
- Broken access control
Not analysed yet 29 Jun 2026
CVE-2026-13524 CVE record

CVSS 6.3 Medium

CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization
- CherryHQ cherry-studio
- Privilege escalation
- Broken access control
Not analysed yet 29 Jun 2026
CVE-2025-61929 CVE record

CVSS 9.7 CriticalCritical · CVSS 9+

Cherry Studio allows one-click on a specific URL to cause a command to execute
- CherryHQ cherry-studio
- Code injection
Not analysed yet 10 Oct 2025
CVE-2025-54382 CVE record

CVSS 9.7 CriticalCritical · CVSS 9+

Cherry Studio RCE Vulnerability Disclosure
- CherryHQ cherry-studio
- Command injection
Not analysed yet 13 Aug 2025
CVE-2025-54074 CVE record

CVSS 7.7 High

Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server
- CherryHQ cherry-studio
- Command injection
Not analysed yet 13 Aug 2025
CVE-2025-54063 CVE record

CVSS 8.0 High

Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling
- CherryHQ cherry-studio
- Code injection
Not analysed yet 11 Aug 2025