Loading story…
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-61929, has been discovered in Cherry Studio, a desktop client supporting multiple large language model (LLM) providers. The flaw, rated with a CVSS score of 9.7, allows attackers to execute arbitrary commands on a victim's system through a specially crafted custom URL protocol. Cherry Studio registers a custom protocol handler, 'cherrystudio://', which is intended to facilitate legitimate operations such as MCP installation. However, the vulnerability arises from the way the application parses base64-encoded configuration data embedded in the URL. When a user clicks on a maliciously crafted 'cherrystudio://mcp' link, the application directly executes the command contained within the URL without adequate validation or user confirmation. This makes it possible for attackers to exploit the flaw by luring users to click on a link embedded in a website, email, or other digital content. The attack is particularly dangerous because the pop-up window generated by the application appears normal, increasing the likelihood that users will trust and interact with it. Once the link is clicked, the malicious command is executed in the context of the user's system, potentially leading to full compromise. As of the time of disclosure, there are no known patched versions available to address this vulnerability, leaving all current installations of Cherry Studio exposed. Security researchers have highlighted the ease of exploitation, noting that the attack can be triggered with a single click, requiring minimal user interaction. The vulnerability affects all versions of Cherry Studio that register and process the custom protocol as described. The issue was reported to security-advisories@github.com and has been publicly documented in security advisories and vulnerability databases. Organizations and individuals using Cherry Studio are urged to exercise extreme caution and avoid clicking on untrusted links until a patch is released. The lack of a fix increases the urgency for users to implement temporary mitigations, such as disabling the custom protocol handler if possible. The vulnerability underscores the risks associated with custom URL protocols in desktop applications, especially when input validation is insufficient. Security teams are advised to monitor for exploitation attempts and consider network or endpoint controls to block malicious protocol invocations. The incident has drawn attention to the broader need for secure handling of custom protocols in software that interfaces with external content.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A critical vulnerability, CVE-2025-61929, was disclosed for Cherry Studio. The flaw was described as allowing one-click remote code execution via a custom URL protocol and assigned a CVSS score of 9.7.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a class of **one-click remote code execution** flaws in desktop applications that passed user-controlled URLs to the operating system without tightly restricting URI schemes or destinations. The issue affected multiple widely used clients, including **Nextcloud, Telegram Desktop, VLC, OpenOffice, LibreOffice, Mumble, Wireshark**, and several Bitcoin-derived wallets, where a single click on a crafted link could trigger unsafe URI handlers, auto-mount remote shares, or launch attacker-controlled content depending on the operating system and desktop environment. The researchers said exploitation was shaped by platform behavior, and warned that application-level fixes alone were not enough without changes in operating systems and frameworks such as **Qt**. A related case showed how the same pattern led to practical exploitation in **Keybase** on Windows, where specially formatted chat links could display benign text while pointing to arbitrary URI targets. In that scenario, attacker-controlled payment-request content using **Lumens (`XLM`)** could be turned into clickable links that executed local or SMB-hosted programs when clicked, creating a viable one-click RCE path. Vendors responded with a mix of mitigations, including restricting allowed schemes, adding warnings, changing URL-opening behavior, removing separate display fields, and forcing non-`HTTP(S)` links to be prefixed safely, although some products were still awaiting fixes at the time of disclosure.
Jul 24, 2026
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-53967, was discovered and disclosed in the Framelink Figma Model Context Protocol (MCP) server, a widely used open-source project that connects AI coding agents to Figma design data. The flaw, which has since been patched, stemmed from unsanitized user input being used directly in shell command construction, leading to a command injection risk. Attackers could exploit this vulnerability by sending specially crafted requests that inject shell metacharacters, allowing them to execute arbitrary system commands under the privileges of the MCP server process. The vulnerability was identified as a design oversight in the fallback mechanism of the server, specifically in the 'src/utils/fetch-with-retry.ts' file, where the server would attempt to fetch content using the standard API and, upon failure, fall back to executing a shell command with unvalidated input. This opened the door for remote attackers to gain full control over the server, potentially exposing sensitive developer data, design assets, and even compromising connected networks. The Framelink Figma MCP server, launched in February 2025, had quickly become one of the most popular tools in its category, with over 10,000 GitHub stars and 600,000 downloads, making the impact of this vulnerability particularly significant. The server is integral to workflows that leverage AI-powered coding agents like Cursor, which automate and streamline the translation of Figma design data into code. The exploitation process involves the MCP client initiating a session and then sending JSONRPC requests to invoke various tools, such as retrieving Figma data or downloading images, with the vulnerability lying in how these requests were handled. Security researchers from Imperva discovered and reported the issue in July 2025, emphasizing the broader risks associated with rapid AI tooling adoption outpacing secure coding practices. The vulnerability highlighted the need for strict dependency management, regular security reviews, and close monitoring of advisories for projects relying on community-driven AI tools. The GitHub advisory for the flaw detailed the technical aspects of the command injection, warning that successful exploitation could lead to data exposure and further compromise. The incident serves as a cautionary tale for developers and organizations integrating AI-driven automation into their workflows, underscoring the importance of robust input validation and secure design principles. The patch for CVE-2025-53967 was released promptly after disclosure, and users were urged to update their MCP server installations immediately. The case also illustrates the growing trend of attackers targeting the AI development ecosystem, where the intersection of automation and design data presents lucrative opportunities for exploitation. Organizations using the Framelink Figma MCP server were advised to review their security posture and implement recommended mitigations to prevent similar incidents in the future. The vulnerability's discovery and responsible disclosure by Imperva contributed to raising awareness about the security challenges inherent in modern AI and design integration platforms.
Jun 29, 2026
A critical security vulnerability has been identified in the MegaSys Enterprises Telenium Online Web Application, allowing unauthenticated attackers to execute arbitrary operating system commands on affected servers. The flaw, tracked as CVE-2025-10659, arises from improper input handling in a PHP endpoint that is accessible over the network without authentication. Specifically, the vulnerability is due to insecure termination of a regular expression check, which fails to adequately validate or sanitize user-supplied input. As a result, attackers can craft malicious HTTP requests that inject OS commands, leading to remote code execution within the security context of the web application service account. The vulnerability affects Telenium Online Web Application versions 8.4.21 and prior, as confirmed by both CVE and CISA advisories. The issue is classified as an OS command injection (CWE-78), a category of vulnerabilities known for their high impact and ease of exploitation. The CVSS v3.1 base score for this vulnerability is 9.8, indicating a critical risk, while a CVSS v4 score of 9.3 further underscores its severity. The vulnerability is remotely exploitable and requires no user interaction or authentication, making it particularly dangerous for internet-exposed systems. Successful exploitation could allow attackers to gain control over the affected server, potentially leading to data theft, service disruption, or lateral movement within the network. The vulnerability was disclosed by ics-cert@hq.dhs.gov and has been publicly documented in both CVE and CISA ICS advisories. Organizations using the Telenium Online Web Application are strongly advised to review their deployments and apply any available patches or mitigations. The advisories do not specify the exact versions affected beyond 8.4.21 and prior, so all users of the product should consider themselves at risk until further information is available. No reports of exploitation in the wild have been confirmed at the time of the advisories' publication, but the low attack complexity and high impact make rapid remediation essential. The vulnerability highlights the ongoing risks associated with improper input validation in web applications, especially those used in industrial control system environments. Security teams should prioritize network segmentation and monitoring for unusual HTTP request patterns targeting the vulnerable endpoint. The incident serves as a reminder of the importance of secure coding practices and regular security assessments for critical infrastructure software.
Jun 29, 2026