CVE-2025-54374

Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted eidos: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (eidos:), causing the Eidos application to launch and process the URL, leading to remote code execution on the victim’s machine. This issue does not have a fix as of October 3, 2025

• CWE-94

• https://github.com/mayneyao/eidos/security/advisories/GHSA-qhhm-56qp-xr2rExploit, Vendor Advisory
• https://github.com/mayneyao/eidos/security/advisories/GHSA-qhhm-56qp-xr2rExploit, Vendor Advisory

Published

Oct 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54368uv is a Python package and project manager written in Rust. …6.8
• CVE-2025-54369Node-SAML is a SAML library not dependent on any frameworks …9.3
• CVE-2025-5437A vulnerability classified as critical has been found in Mul…6.9
• CVE-2025-54370PhpOffice/PhpSpreadsheet is a pure PHP library for reading a…8.7
• CVE-2025-54371Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2025-54373OpenEMR is a free and open source electronic health records …6.5
• CVE-2025-54376Hoverfly is an open source API simulation tool. In versions …7.5
• CVE-2025-54377Roo Code is an AI-powered autonomous coding agent that lives…7.8
• CVE-2025-54378HAX CMS allows you to manage your microsite universe with PH…8.3
• CVE-2025-54379LF Edge eKuiper is a lightweight IoT data analytics and stre…9.8
• CVE-2025-5438A vulnerability was found in Linksys RE6500, RE6250, RE6300,…8.8
• CVE-2025-54380Opencast is a free, open-source platform to support the mana…6.5