Critical · published October 11, 2025
🚨 A single crafted click can trigger a chain reaction of chaos! Cherry Studio's custom protocol allows attackers to execute malicious commands just by enticing users with seemingly innocent content. 🔥 Think of it like a magician’s trick where a seemingly harmless box can suddenly unleash a swarm of bees when you open it. Here, the `cherrystudio://` protocol is that box, and clicking the wrong link could send your system into a frenzy! Once an attacker crafts their malicious potion and embeds it into a trusted site, any unsuspecting user who clicks on it could unknowingly execute harmful commands. This could lead to the unauthorized access of sensitive data, system compromise, or even severe disruptions, turning your desktop client into a hacker's playground!
Think of it like a magician’s trick where a seemingly harmless box can suddenly unleash a swarm of bees when you open it. Here, the `cherrystudio://` protocol is that box, and clicking the wrong link could send your system into a frenzy! Cherry Studio's vulnerability stems from its handling of the MCP installation URL, where base64-encoded commands are executed directly without proper validation. This means that an attacker can exploit this flaw by crafting malicious URLs that, when clicked, execute harmful commands directly in the user's environment.
Once an attacker crafts their malicious potion and embeds it into a trusted site, any unsuspecting user who clicks on it could unknowingly execute harmful commands. This could lead to the unauthorized access of sensitive data, system compromise, or even severe disruptions, turning your desktop client into a hacker's playground! To protect yourself, be vigilant about the URLs you click, especially from unfamiliar sources. Monitor for updates from Cherry Studio and urge the developers to patch this vulnerability as soon as possible. Consider disabling or limiting the use of the custom protocol until a fix is released. 🛡️ You've got this! Stay aware and keep your systems safe while you navigate the digital world! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| cherry-ai/cherry_studio | < 1.6.4 | 1.6.4 |