Cherry Studio 未授权 代码注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://zhi.oscs1024.com/43672.html
• https://blog.csdn.net/murphysec/article/details/150341447
• https://cn-sec.com/archives/4364240.html
• https://www.gm7.org/archives/1940
• https://www.ctfiot.com/275030.html
• https://www.secrss.com/articles/81925
• https://www.oscs1024.com/hd/MPS-qsoz-5vt4
• https://github.com/CherryHQ/cherry-studio/security/advisories/GHSA-8xr5-732g-84px
• https://github.com/CherryHQ/cherry-studio/security
• https://rivers.chaitin.cn/vuldb/1628e2f4-542a-44b3-9a37-40e5272f2f5d

Related Vulnerabilities

• 时空智友ERP系统 /formservice updater.uploadStudioFile 文件上传漏洞
• PoCCVE-2025-25296: Label Studio < 1.16.0 - Cross-Site Scripting
• PoCCVE-2025-47783: Label Studio < 1.18.0 - Reflected XSS
• Label Studio存在XSS漏洞(CVE-2025-25296)
• PoCsupabase-studio-exposure: Supabase Studio - Exposure
• PoCCVE-2024-14015: Studiocart <= 2.9.0 - Cross-Site Scripting
• PoCvscode-settings: Visual Studio Code Settings - Credential Exposure
• PoCvscode-mcp-json: Visual Studio Code MCP Configuration ("mcp.json") Exposure
• PoCvscode-slnx-sqlite-disclosure: Visual Studio Code - Slnx.SQLite File Disclosure
• Sim Studio AI 服务端请求伪造漏洞(CVE-2025-9805)
• IBM Watson Studio on Cloud Pak for Data 跨站脚本漏洞
• Cherry Studio 命令注入漏洞
• PoCCVE-2019-8982: Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery