CVE-2026-40501

HighCVSS 8.8

Published: 15/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.81%

56th percentile - higher than 56% of all known CVEs

Summary

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService. Attackers can deliver malicious JavaScript through controlled search provider content into an Electron BrowserWindow with nodeIntegration enabled and contextIsolation disabled.

Risk Assessment

The risk is critical – attackers gain full Node.js access (fs, child_process, os, process.env) under the operating system account of the Cherry Studio process, potentially leading to system compromise, data theft, or lateral movement.

Recommendation

Immediately update Cherry Studio to a version containing commit 1518530 or later. Additionally, enable contextIsolation and disable nodeIntegration for all Electron BrowserWindow instances in the configuration.

Other vulnerabilities in Cherry Studio

CVE-2025-61929Critical
Cherry Studio registers a custom protocol called cherrystudio://, which when handling the MCP installation URL parses base64-encoded configuration data and directly executes the command within it. An attacker can post malicious content on a website, and when the user clicks it, the malicious command is triggered. As of publication, no known patched versions exist.

Original NVD description (English source)

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScript through controlled search provider content loaded into an Electron BrowserWindow configured with nodeIntegration enabled and contextIsolation disabled. Attackers who control a search engine provider, individual search result pages, or provider settings pages can execute JavaScript with full Node.js privileges, gaining access to fs, child_process, os, and process.env under the operating-system account of the Cherry Studio process.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS