Custom Protocol Vulnerability in Cherry Studio Desktop Client

CVE-2025-61929

What is CVE-2025-61929?

Cherry Studio, a desktop client for multiple LLM providers, contains a vulnerability that allows an attacker to exploit the custom protocol cherrystudio://. This occurs when the software processes MCP installation URLs, leading to the execution of arbitrary commands derived from base64-encoded data. An attacker could create a malicious link that appears legitimate. When a user clicks it, the malicious command executes against the user's setup. Currently, no patched versions have been released, leaving users exposed to potential exploits. To protect your system, exercise caution when interacting with URLs associated with Cherry Studio and stay updated on advisories.

References