Cherry Studio Electron RCE via nodeIntegration:true in Search Window

Vulnerability Overview Cherry Studio’s web search implementation creates an Electron with and , then loads remote content. JavaScript provided by the page can use Node.js APIs (such as , , , and ). The local search provider path loads the configured search engine URL for each search into this privileged window. Additional paths load single result pages when is enabled, and open local provider websites in the same window. Consequently, remote JavaScript runs with the operating system privileges of the Cherry Studio process, allowing it to read or modify files, execute commands, and access credentials available to the user. Scope Affected Versions: >= 1.2.2, <= 1.6.12 Severity: Critical CVSS 3.1: 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H) Remediation No patch version is currently available. Affected Code Creation of the Privileged Search Window Loading the Provided URL and Executing the Page Attack Paths 1. Local Search Provider - Unconditionally loads the configured search URL into the privileged window. - The page and any scripts it contains have access to Node.js. 2. Search Result Page - When is enabled, loads a single result URL into the same window. - SearXNG and the local provider pass the setting to this function when retrieving result content. This setting is disabled by default, making this path optional. 3. Provider Settings - Local provider settings actions open the provider's website in the privileged window. Attack Conditions The local search provider page is always loaded into the privileged window when the provider is used. Exploitation requires attacker-controlled JavaScript to run within the search page, such as via an infected page or a third-party script. Loading individual search results requires to be enabled. Once enabled, attacker-controlled search result URLs are loaded directly into the privileged window. The settings path requires attacker-controlled JavaScript within the provider website loaded by the application. In all cases, the user must initiate a search or open the provider website. Remote pages do not require separate permission prompts to gain Node.js access. Minimal Proof of Concept (POC) The following page demonstrates accessing Node.js to create a harmless marker file in the OS temporary directory: Impact Remote page JavaScript runs with the privileges of the desktop application rather than those of a normally sandboxed browser page. A successful attack can: Read or modify files accessible to the user; Access application data, API keys, SSH keys, and cloud credentials; Execute local programs or shell commands; Modify startup files or other persistence locations; Terminate processes or delete user data. User interaction is required to initiate the affected search or open the provider settings page. Attacker-controlled accounts or application permissions are not required. Disclosure Timeline April 10, 2025: The affected implementation was introduced in a public commit. April 11, 2025: Cherry Studio 1.2.2, the first affected version, was released. April 8, 2025: The report was submitted via GitHub Private Vulnerability Reporting. July 3, 2025: The legacy path was removed from the main branch. July 5, 2025: A stable version containing the affected code was released. July 16, 2025: Technical details were publicly disclosed. References GitHub Security Advisory: GHSA-jhw3-9q9r-gc5w Introductory Commit: Link Main Branch Removal Commit: Link Electron Security Guide: Link

Goal Reached Thanks to every supporter — we hit 100%!

Cherry Studio Electron RCE via nodeIntegration:true in Search Window