Local Privilege Escalation in Clash Verge Rev Product by Clash Verge
CVE-2025-50505

7.8HIGH

Key Information:

Vendor

Clash Verge

Status
Clash Verge Rev
Vendor
CVE Published:
7 October 2025

What is CVE-2025-50505?

The Clash Verge Rev product (versions up to 2.2.3) contains a vulnerability that enables local privilege escalation. This issue arises from the forced installation of system services (clash-verge-service) by default, which makes it possible for local users to exploit the unauthorized HTTP API endpoint '/start_clash'. Attackers are able to submit arbitrary 'bin_path' parameters that are executed directly by the service process, leading to potential unauthorized access and escalation of privileges within the affected system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/clash-verge-rev/clash-verge-rev
https://github.com/clash-verge-rev/clash-verge-service
https://www.clashverge.dev/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.