Vulnerability Description
Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL on any website. If a victim clicks the exploit link in their browser, the app’s custom URL handler is triggered, leading to remote code execution on the victim’s machine. This issue has been patched in version 1.5.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cherry-Ai | Cherry Studio | >= 1.4.8, < 1.5.1 |
Related Weaknesses (CWE)
References
- https://github.com/CherryHQ/cherry-studio/commit/ff72c007c03ff47de21a4d0bf52a1ffPatch
- https://github.com/CherryHQ/cherry-studio/pull/8218Patch
- https://github.com/CherryHQ/cherry-studio/security/advisories/GHSA-p6vw-w3p8-4g7ExploitVendor Advisory
FAQ
What is CVE-2025-54063?
CVE-2025-54063 is a vulnerability with a CVSS score of 8.0 (HIGH). Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An a...
How severe is CVE-2025-54063?
CVE-2025-54063 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-54063?
Check the references section above for vendor advisories and patch information. Affected products include: Cherry-Ai Cherry Studio.