Listen to this Post
How the CVE works:
Cherry Studio uses a custom URL scheme (e.g., cherry://) for deep linking. In versions 1.4.8 to 1.5.0, the handler fails to sanitize input from URL parameters. When a user clicks a malicious cherry:// URL, the OS passes it to the app. The app parses the URL and executes commands embedded in the parameters. This is due to improper validation where user input is directly used in system calls or eval functions. An attacker crafts a URL with shell commands in parameters. For example, a payload like “cherry://run?command=rm -rf /” could be injected. The victim’s browser triggers the scheme, launching Cherry Studio. The app then processes the URL, concatenating inputs into executable strings. This allows arbitrary command injection. The attack requires user interaction but only a single click. Exploitation leads to code execution with user privileges. The vulnerability stems from trusting unsanitized URL data. Patches in 1.5.1 add input validation and escaping.
Platform: Cherry Studio
Version: 1.4.8 to 1.5.0
Vulnerability: Remote Code Execution
Severity: Critical
Date: 08/11/2025
Prediction: 2025-08-11
What Undercode Say:
Analytics:
- Check scheme: `ls -la ~/.config/cherry/`
– Test handler: `xdg-open cherry://test`
– Exploit code: `cherry://run?cmd=id`
How Exploit:
Craft malicious URL.
Host on website.
Victim clicks link.
Handler executes payload.
Protection from this CVE
Update to 1.5.1.
Disable custom handler.
Use application allowlisting.
Impact:
Full system compromise.
Data theft.
Ransomware deployment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
