What’s Vulnerable › Products

CherryHQ cherry-studio vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your CherryHQ cherry-studio version is affected

Latest CherryHQ cherry-studio vulnerabilities

• CVE-2026-40501 — Cherry Studio RCE via SearchService nodeIntegration Misconfiguration (CVSS 8.8)
• CVE-2026-13534 — CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization (CVSS 5.0)
• CVE-2026-13524 — CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization (CVSS 5.6)
• CVE-2025-61929 — Cherry Studio allows one-click on a specific URL to cause a command to execute (CVSS 9.6)
• CVE-2025-54382 — Cherry Studio RCE Vulnerability Disclosure (CVSS 8.8)
• CVE-2025-54074 — Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server (CVSS 9.8)
• CVE-2025-54063 — Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling (CVSS 9.6)