CyberRota Analysis
AI-GeneratedCherry Studio versions 1.2.2 through 1.9.12 are vulnerable to a remote code execution flaw in the SearchService, which allows attackers to execute arbitrary code by injecting malicious JavaScript into an Electron BrowserWindow with nodeIntegration enabled and contextIsolation disabled. This vulnerability grants attackers full Node.js privileges, enabling access to sensitive system resources and potentially compromising the host operating system. Organizations using affected versions of Cherry Studio should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScript through controlled search provider content loaded into an Electron BrowserWindow configured with nodeIntegration enabled and contextIsolation disabled. Attackers who control a search engine provider, individual search result pages, or provider settings pages can execute JavaScript with full Node.js privileges, gaining access to fs, child_process, os, and process.env under the operating-system account of the Cherry Studio process.