CVE-2025-66562 is a critical (CVSS 9.6) flaw in TUUI, a desktop MCP client. Script inside ECharts code blocks in rendered Markdown can reach an exposed IPC interface that spawns processes, so viewing a malicious message can run commands. Fixed in 1.3.4. The advisory rates it High at 8.9.
What's affected
- Product: TUUI, a desktop client for the Model Context Protocol.
- Affected: versions before 1.3.4.
- Fixed: 1.3.4. The release notes say the ECharts library dependency was removed.
Severity differs by source. The record gives CVSS 9.6 (critical). The GitHub advisory scores it 8.9 (High) under CVSS 4.0. Both agree on the fix version.
How to check if you're exposed
Open the application and check the version in the About screen, and compare it with 1.3.4. On managed machines, search your software inventory for TUUI.
npm ls tuui
If you installed it from a release package, the version is the one on the download. Anyone who has used the client with remote models, shared chats or web content has been in the situation the advisory describes.
What to do now
- Update TUUI to 1.3.4 or later.
- Tell users not to render Markdown from untrusted sources in older builds. The advisory notes the issue can be avoided if the user never asks the AI to produce ECharts code blocks, which is a weak control, so do not rely on it.
- Review which MCP servers are configured on each machine and remove ones nobody recognizes.
- Run desktop AI tools under standard user accounts.
- Keep an inventory of desktop AI clients and their versions. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The advisory describes a chain of design choices. The page security policy allows evaluating strings as code. The Markdown renderer evaluates ECharts code blocks as JavaScript with no restriction on what that script can touch. And the preload script exposes an IPC invoke function to the renderer, with a handler that starts MCP servers using a command and arguments passed to a process spawn call. The record tags it CWE-79, CWE-94.
AI clients render content from models, tools and the web, and all of that is untrusted. When the renderer also holds a bridge to the operating system, a chat message becomes a way to run code. The record does not list exploitation in the wild, and the CVE is not on CISA KEV.
Quick check
Which version has the fix?
1.3.4. The release removed the ECharts dependency.
Why is this critical in the record but High in the advisory?
The record carries a CVSS 3.1 score of 9.6 and the advisory a CVSS 4.0 score of 8.9. Both treat it as serious.
Sources
Last reviewed: 18 October 2026.
