CVE-2025-54382 in cherry-studio
Summary
by MITRE • 08/13/2025
Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution (RCE) vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirection endpoints and failure to properly sanitize the URL. This issue has been patched in version 1.5.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 12/01/2025
The vulnerability identified as CVE-2025-54382 affects Cherry Studio version 1.5.1, a desktop client application designed to interface with multiple large language model providers through the Model Control Protocol. This security flaw represents a critical remote code execution vulnerability that stems from improper input validation and trust assumptions within the application's connection handling mechanism. The vulnerability specifically manifests when the client establishes connections to streamableHttp MCP servers, creating a pathway for malicious actors to execute arbitrary code on affected systems. The root cause lies in the application's implicit trust model toward OAuth authentication redirection endpoints, which creates an attack surface where untrusted input can be leveraged to compromise system integrity.
Technical exploitation of this vulnerability occurs through manipulation of URL parameters during the OAuth authentication flow, where the application fails to properly sanitize input received from the MCP server. This lack of input sanitization creates a classic command injection scenario where maliciously crafted URLs can be interpreted by the application as executable commands. The vulnerability aligns with CWE-74 and CWE-79 principles, representing improper neutralization of special elements used in data queries and injection flaws that can lead to arbitrary code execution. When combined with the trust model that assumes all communication from MCP servers is legitimate, an attacker can craft malicious redirection URLs that bypass normal security controls and execute code within the context of the running Cherry Studio application. The attack vector demonstrates characteristics consistent with ATT&CK technique T1059.007 for command and scripting interpreter, where adversaries leverage legitimate system tools to execute malicious code.
The operational impact of this vulnerability extends beyond simple code execution, as it allows attackers to gain full control over affected systems running Cherry Studio 1.5.1. An attacker with access to a streamableHttp MCP server could manipulate the OAuth redirection flow to inject malicious commands that would execute with the privileges of the user running the Cherry Studio application. This creates potential for data exfiltration, system compromise, and further lateral movement within networks where the vulnerable software is deployed. The vulnerability affects organizations that rely on Cherry Studio for LLM interactions, particularly those in environments where multiple MCP servers are trusted and where the application may be running with elevated privileges. The attack requires minimal prerequisites beyond access to a compromised MCP server, making it particularly dangerous in scenarios where organizations have numerous trusted endpoints or where server compromise is possible through other attack vectors.
Organizations should immediately upgrade to Cherry Studio version 1.5.2, which includes patches addressing the URL sanitization issues and the overly permissive trust model in OAuth redirection handling. The fix implements proper input validation and sanitization of URL parameters received from MCP servers, ensuring that all external inputs are properly escaped and validated before processing. Security teams should also implement network segmentation and monitoring to detect suspicious OAuth redirection patterns and unusual network traffic to MCP servers. Additional mitigations include configuring the application to use explicit trust models for MCP server connections rather than implicit trust, implementing network-based controls to restrict access to MCP endpoints, and conducting security reviews of all trusted MCP server configurations to ensure they are not compromised. The vulnerability demonstrates the importance of validating all inputs regardless of their source and implementing defense-in-depth strategies that do not rely solely on trust assumptions for security boundaries.