Executive brief
Cherry Studio, a desktop application, contains a security flaw in how it handles web searches. If a user performs a search or visits a search provider's settings, a malicious website can bypass security protections to run commands directly on the user's computer. This could allow an attacker to steal sensitive files, access credentials, or take full control of the affected system.
Technical details
A remote code execution vulnerability exists in Cherry Studio's SearchService due to the creation of an Electron BrowserWindow with 'nodeIntegration' enabled and 'contextIsolation' disabled. When the application loads remote content—such as search provider URLs, individual search result pages (if 'usingBrowser' is enabled), or provider settings pages—any JavaScript on those pages can access powerful Node.js APIs like 'fs' and 'child_process'. An attacker who controls a search engine or compromises a search result page can execute arbitrary commands under the privileges of the operating system account running Cherry Studio. The vulnerability was addressed by removing the legacy SearchService and its associated IPC channels in commit 1518530.
Affected products
- CherryHQ cherry-studio 1.2.2 through 1.9.12
Timeline
- 2025-04-10: other: Vulnerable code introduced in commit f9c6bdd
- 2026-04-08: disclosed: Reported via GitHub Private Vulnerability Reporting
- 2026-07-03: patched: Fixed in commit 151853035e8e417a51559ebfc243eda98361a882
- 2026-07-15: advisory: Public disclosure of CVE-2026-40501