Skip to content
Threat Feed
Subscribe

Vendor

Cherry Studio

1 brief RSS
high advisory

Cherry Studio Remote Code Execution Vulnerability (CVE-2026-40501)

A remote code execution vulnerability, CVE-2026-40501, exists in Cherry Studio versions 1.2.2 through 1.9.12 due to improper Electron BrowserWindow configuration, allowing remote attackers to execute arbitrary code by injecting malicious JavaScript through controlled search provider content, thereby gaining full Node.js privileges and accessing system resources.

Cherry Studio 1.2.2 +1 remote-code-execution electron-vulnerability application-security
1r 1t 1c