Description
Cherry Studio 是一款跨平台桌面AI助手，支持多种主流大语言模型（LLM），兼容 Windows、Mac 和 Linux 系统。
2025年8月，Cherry Studio官方发布安全通告预警Cherry Studio命令注入漏洞(CVE-2025-54074)。该漏洞导致恶意MCP服务器可通过<=v1.5.1版本的Cherry Studio在受害者主机上执行任意命令。建议受影响的用户及时更新版本进行修复。
Cherry Studio 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://blog.csdn.net/murphysec/article/details/150341447
https://github.com/CherryHQ/cherry-studio/security/advisories/GHSA-8xr5-732g-84px
https://nvd.nist.gov/vuln/detail/CVE-2025-54074
https://www.sentinelone.com/vulnerability-database/cve-2025-61929/
https://www.cvedetails.com/cve/CVE-2025-54074/
https://dev.to/sharon_42e16b8da44dabde6d/cherry-studio-command-injection-vulnerability-cve-2025-54074-patch-now-4lk1
https://access.redhat.com/security/cve/cve-2025-54074
https://x.com/_r00tuser/status/1955165399223591402