CVE-2025-54074 is a Critical severity OS command injection (CVSS 9.8) in Cherry Studio, the desktop client for several LLM providers. It affects versions 1.2.5 to 1.5.1 when connecting to a malicious MCP server in HTTP Streamable mode. Version 1.5.2 fixes it.
What's affected
The advisory says versions 1.2.5 up to 1.5.1 are affected. The patched version is 1.5.2.
The flaw appears when the client connects to an MCP server in HTTP Streamable mode. Model Context Protocol servers give an AI client extra tools. The advisory says an attacker can set up a malicious MCP server with compatible OAuth authorization server endpoints, and trick a victim into connecting to it. In vulnerable clients this leads to OS command injection.
The key point is that the dangerous side is the server the user connects to, so the trust you place in each MCP server matters as much as the version.
How to check if you're exposed
Check the installed version on each machine in the app or with your endpoint management tool. On macOS:
defaults read /Applications/Cherry\ Studio.app/Contents/Info CFBundleShortVersionString
Anything from 1.2.5 to 1.5.1 is affected. Then list the MCP servers each person has configured, especially remote ones in HTTP Streamable mode. Any server that was added from a link, a chat message or a public list, and that nobody on the team vets, deserves review.
What to do now
- Update Cherry Studio to 1.5.2 or later on every machine.
- Review the configured MCP servers and remove any you cannot tie to a known owner or vendor.
- Add only MCP servers from sources you trust, and avoid adding a remote server from an unsolicited link.
- Rotate API keys and tokens that live on any machine that connected to an unfamiliar server before the update.
- Treat desktop AI clients as software that needs patching and inventory, like a browser.
Why it matters
The weakness is CWE-78, OS command injection. Data supplied by the remote server during the connection and authorization steps ends up in a command that the client runs on the local machine. The client trusted the server more than it should have.
This is a good example of how agent tooling moves the trust boundary. An MCP server is not a passive data source. It talks to your client, returns values that the client acts on, and so must be treated as untrusted input unless you control it.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The advisory does not report attacks. The Critical score comes from network reach and the lack of privileges, although the user must still connect to the malicious server, which is why the vetting step matters.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I have to connect to a bad server for this to matter?
Yes. The advisory says the attacker has to trick a victim into connecting to a malicious MCP server. That is why checking server sources matters as much as updating.
Is this the same as CVE-2025-54063?
No. That is a separate one-click flaw through the custom URL handler, fixed in 1.5.1. This one needs 1.5.2.
Sources
Last reviewed: 18 October 2026.
