CVE-2025-54063: Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling
Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL on any website. If a victim clicks the exploit link in their browser, the app’s custom URL handler is triggered, leading to remote code execution on the victim’s machine. This issue has been patched in version 1.5.1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54063?
CVE-2025-54063 is a critical vulnerability as it allows for remote code execution.
How do I fix CVE-2025-54063?
To mitigate CVE-2025-54063, upgrade Cherry Studio to version 1.5.1 or later.
What versions of Cherry Studio are affected by CVE-2025-54063?
CVE-2025-54063 affects Cherry Studio versions from 1.4.8 to 1.5.0.
What type of vulnerability is CVE-2025-54063?
CVE-2025-54063 is categorized as a remote code execution vulnerability.
Who can exploit CVE-2025-54063?
An attacker can exploit CVE-2025-54063 by hosting a malicious website or embedding harmful URLs.