Vulnerability · Published Aug 13, 2025 · Assigned by GitHub_M

CVE-2025-54074Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server

High 7.7

In plain English

A high-severity OS command injection in cherry-studio from CherryHQ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)2.1%top 18.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malicious MCP server with compatible OAuth authorization server endpoints and trick victims into connecting it, leading to OS command injection in vulnerable clients. This issue has been patched in version 1.5.2.

Affected products (as reported)

Vendor	Product	Versions
CherryHQ	cherry-studio	>= 1.2.5, < 1.5.2

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/CherryHQ/cherry-studio/security/advisories/GHSA-8xr5-732g-84px x_refsource_CONFIRM
https://github.com/CherryHQ/cherry-studio/commit/40f9601379150854826ff3572ef7372fb0acdc38 x_refsource_MISC