A code injection vulnerability in Cherry Studio allows remote attackers to execute arbitrary code via malicious custom protocol URIs.

This vulnerability (CWE-94) occurs when the application handles the cherrystudio:// custom protocol. An attacker can craft a malicious URL that triggers improper control of code generation, leading to remote code injection when the link is clicked by a user.

Successful exploitation could lead to full desktop client compromise, including the theft of stored LLM API keys or local data. With a CVSS score of 9.6, this represents a major threat to any organization using Cherry Studio, as user interaction (clicking a link) is the only prerequisite for execution.

Immediate Action: Update Cherry Studio to the latest version immediately to resolve the protocol handler vulnerability.

Proactive Monitoring: Review endpoint security logs for unusual process spawning behavior linked to the Cherry Studio application.

Compensating Controls: Use browser or OS-level restrictions to warn or block the execution of custom protocol handlers from untrusted sources if immediate updating is delayed.

Public Exploit Available: No (exploit_available: unknown)

Given the ease of delivery via malicious links and the high CVSS score, all users must update their installation immediately. Security teams should ensure that all endpoints running Cherry Studio are updated to patch this critical injection flaw.