This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Cherry Studio v1.5.1 suffers from **OS Command Injection** (CWE-78).โฆ
๐ก๏ธ **Root Cause**: **Improper Neutralization of Special Elements** (CWE-78). The application fails to sanitize URLs when establishing the **streamableHttp MCP server connection**.โฆ
๐ฅ **Affected**: Users of **Cherry Studio version 1.5.1**. ๐ข **Vendor**: CherryHQ (Cherry Studio). ๐ฆ **Component**: The streamableHttp MCP server connection module.
Q4What can hackers do? (Privileges/Data)
๐ **Privileges**: **High** (CVSS A:H). Attackers gain the ability to execute arbitrary commands. ๐ **Data**: **High** (CVSS C:H/I:H).โฆ
โ ๏ธ **Threshold**: **Low** (CVSS AC:L). However, it requires **User Interaction** (UI:R). ๐ฑ๏ธ The victim must likely initiate or approve the MCP server connection with a malicious URL.โฆ
๐ซ **Public Exploit**: **No**. The `pocs` field is empty. ๐ **Advisory**: A GitHub Security Advisory (GHSA-gjp6-9cvg-8w93) exists, but no public Proof-of-Concept (PoC) or wild exploitation code is currently available.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Verify if you are running **Cherry Studio v1.5.1**. ๐ Check for any custom or third-party MCP server configurations using the `streamableHttp` protocol.โฆ
๐ก๏ธ **Official Fix**: **Yes**. The vendor has published a security advisory on GitHub. ๐ **Action**: Update to the patched version immediately. Refer to the GHSA link for specific patch details.
Q9What if no patch? (Workaround)
๐ง **Workaround**: If patching is delayed, **disable** or **restrict** the use of the `streamableHttp` MCP server connection. ๐ซ Do not input URLs from untrusted sources into the connection field.โฆ
๐ฅ **Urgency**: **HIGH**. CVSS Score is **Critical** (9.8 implied by H/H/H). ๐จ Even though User Interaction is required, the impact is severe (RCE). ๐โโ๏ธ **Priority**: Patch immediately upon release. Monitor for updates.