CVE-2025-54063 is a High severity one-click remote code execution flaw (CVSS 8.0) in Cherry Studio, the desktop client for several LLM providers. The custom URL handler can be triggered from a web page. It affects versions 1.4.8 to 1.5.0, and 1.5.1 fixes it.
What's affected
The advisory says versions 1.4.8 up to 1.5.0 are affected, and that the problem is patched in 1.5.1.
The advisory describes the weakness in the handling of the application's custom URL scheme. A website or a link embedded in any page can point at that scheme. If a person clicks it in a browser, the desktop app is launched and handles the request, and in the affected versions that leads to code execution on the machine.
A separate record, CVE-2025-54074, covers a command injection through MCP servers in versions up to 1.5.1. Updating to 1.5.2 or later covers both.
How to check if you're exposed
On each machine, open the application and check the version in its settings or about screen. On macOS and Linux you can often read it from the installed package:
defaults read /Applications/Cherry\ Studio.app/Contents/Info CFBundleShortVersionString
An answer from 1.4.8 to 1.5.0 is affected. For a fleet, use your endpoint management tool to list installed versions. Also check whether anyone has started the app from a link they did not expect, which would be unusual for a desktop chat client.
What to do now
- Update Cherry Studio to 1.5.2 or later on every machine, which also covers CVE-2025-54074.
- Use endpoint management to list installed versions and push the update to machines that lag.
- Until updated, tell users not to click links to unknown sites while the app is installed, and consider removing the app from sensitive machines.
- Keep API keys for model providers in a store that the app cannot expose, and rotate them if a machine looks affected.
- Add desktop AI clients to the software inventory so they receive updates like any other application.
Why it matters
The weakness is CWE-94, code injection. Custom URL schemes let a web page start a local application with data the page controls. That is convenient, and it is also a trust boundary: any website can send those links, so the app must treat the data as hostile and must never run it as code.
The score is High and not Critical because the user has to click. One click is a low bar, though. Links can sit in an email, a chat message or an ordinary web page.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The advisory does not describe attacks. Desktop AI clients often store provider keys and chat history, so a code execution flaw there reaches data that is valuable on its own.
Quick check
What does one-click mean?
The user only has to click a link. No further prompt or step is needed for the flaw to be triggered in the affected versions, according to the advisory.
Is 1.5.1 enough?
It fixes this CVE. A different flaw, CVE-2025-54074, affects versions up to 1.5.1, so update to 1.5.2 or later.
Sources
Last reviewed: 18 October 2026.
