Remote Code Execution Vulnerability in Cherry Studio by Cherry HQ
CVE-2025-54382

9.7CRITICAL

Key Information:

Vendor

Cherryhq

Status
Cherry-studio
Vendor
CVE Published:
13 August 2025

What is CVE-2025-54382?

A remote code execution vulnerability has been identified in Cherry Studio version 1.5.1, which affects users connecting to streamableHttp MCP servers. This security flaw stems from the application’s unsuspected reliance on oauth redirection endpoints, coupled with inadequate URL sanitization. This exploit allows malicious actors to execute arbitrary code remotely on the affected systems. Users are strongly advised to upgrade to version 1.5.2 to mitigate these security risks.

Affected Version(s)

cherry-studio = 1.5.1

References

https://github.com/CherryHQ/cherry-studio/security/adviso...
x_refsource_CONFIRM

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.7
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.