CVE-2025-54382
Last modified
CVE-2025-54382 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution (RCE) vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. EPSS estimates a 5.45% chance of exploitation in the next 30 days.
Description
Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution (RCE) vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirection endpoints and failure to properly sanitize the URL. This issue has been patched in version 1.5.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cherry-Ai | Cherry Studio | < 1.5.2 |
References
- https://github.com/CherryHQ/cherry-studio/security/advisories/GHSA-gjp6-9cvg-8w93Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-54382?
How severe is CVE-2025-54382?
How do I fix CVE-2025-54382?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54377Roo Code is an AI-powered autonomous coding agent that lives…7.8
- CVE-2025-54378HAX CMS allows you to manage your microsite universe with PH…8.3
- CVE-2025-54379LF Edge eKuiper is a lightweight IoT data analytics and stre…9.8
- CVE-2025-5438A vulnerability was found in Linksys RE6500, RE6250, RE6300,…8.8
- CVE-2025-54380Opencast is a free, open-source platform to support the mana…6.5
- CVE-2025-54381BentoML is a Python library for building online serving syst…9.9
- CVE-2025-54384CKAN is an open-source DMS (data management system) for powe…6.3
- CVE-2025-54385XWiki Platform is a generic wiki platform offering runtime s…9.8
- CVE-2025-54386Traefik is an HTTP reverse proxy and load balancer. In versi…9.8
- CVE-2025-54387IPX is an image optimizer powered by sharp and svgo. In vers…9.8
- CVE-2025-54388Moby is an open source container framework developed by Dock…4.6
- CVE-2025-54389AIDE is an advanced intrusion detection environment. Prior t…5.5
Are you affected by CVE-2025-54382?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST