Arbitrary Command Execution Vulnerability in Dive MCP Host Desktop Application by OpenAgentPlatform
CVE-2026-23523

9.7CRITICAL

Key Information:

Vendor

Openagentplatform

Status
Dive
Vendor
CVE Published:
16 January 2026

What is CVE-2026-23523?

A vulnerability exists in the Dive MCP Host Desktop Application prior to version 0.13.0, where a crafted deeplink can be used to install an attacker-controlled MCP server configuration without adequate user confirmation. This flaw can lead to arbitrary command execution on the victim's machine, posing a significant security risk. It is crucial for users to upgrade to version 0.13.0 or later to mitigate this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Dive < 0.13.0

References

https://github.com/OpenAgentPlatform/Dive/security/adviso...
x_refsource_CONFIRM
https://github.com/OpenAgentPlatform/Dive/commit/a5162ac9...
x_refsource_MISC

CVSS V3.1

Score:
9.7
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.