CVE-2025-54382 - CVE House
Back to Database
Status published Critical CVE-2025-54382

Cherry Studio RCE Vulnerability Disclosure

Vulnerability Description

Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution (RCE) vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirection endpoints and failure to properly sanitize the URL. This issue has been patched in version 1.5.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54382

Credits & Attribution

No credits recorded in the NVD database.

References

More from CherryHQ

View All →
CVE-2025-61929
Cherry Studio allows one-click on a specific URL to cause a command to execute
Critical 9.7
CVE-2025-54074
Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server
High 7.7
CVE-2025-54063
Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling
High 8

Affected Vendor

Affected Software

cherry-studio
Vulnerable Versions:
= 1.5.1

Timeline

Official Publish: August 13th, 2025
Last Modified: August 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration