CVE-2025-66580 is a critical (CVSS 9.6) stored cross site scripting flaw in Dive, an open source desktop host for MCP and function calling models. A crafted Mermaid diagram can run script and register a malicious MCP server. Upgrade to Dive 0.11.1.
What's affected
Dive versions before 0.11.1. The GitHub advisory lists v0.11.0 and earlier as affected and v0.11.1 as the patched release. Both the record and the advisory rate it 9.6, critical.
Dive is a desktop application, so every user who installed it needs the update. There is no server fleet to patch, which makes it easy to miss. The advisory also points out that the flaw resembles an earlier issue in another AI chat client that used the same diagram library, so other tools in the same family may need checking too.
How to check if you're exposed
Open the application and read the version in the About or Settings screen. If it is below 0.11.1, update it.
If you manage laptops centrally, search your software inventory for the application name and compare versions. For teams that build Dive from source, check the tag you built from:
git describe --tags
The advisory notes the root cause was the diagram library's security level being set to loose. If you embed Mermaid in your own application, search your code for the same setting:
grep -rn "securityLevel" src
What to do now
- Update every Dive install to 0.11.1 or later.
- Open the MCP server configuration and delete any server entry you did not add yourself.
- Do not click interactive nodes in diagrams that came from untrusted conversations or documents until you have updated.
- If you embed Mermaid elsewhere, set the security level to strict and sanitize rendered output.
- Review which MCP servers are allowed to run commands on user machines, and prefer an approved list.
Why it matters
Dive renders model output, and model output can contain a diagram. The advisory says the Mermaid library was configured with a loose security level, which allows click handlers that use the javascript: scheme. A diagram that a model was coaxed into writing can therefore run script in the application's own page.
That script can call the app's local configuration endpoint, add a new MCP server definition and cause a command to be started. The class is CWE-79 (cross site scripting) leading to CWE-94 (code injection). The pattern matters beyond this one product: desktop AI clients mix untrusted model text with privileged local APIs, and a rendering bug becomes code execution. The record does not list this CVE as exploited in the wild.
Quick check
Do I need to be tricked into clicking?
The advisory says the code runs when the diagram node is clicked, so user interaction is part of it. Updating still matters because the diagram can arrive through ordinary chat content.
What fixed it?
Dive 0.11.1, per the record and the GitHub advisory.
Sources
Last reviewed: 18 October 2026.
