Cherry Studio では、特定の URL をワンクリックすることでコマンドを実行させることが可能

The vulnerability lies in how Cherry Studio handles the cherrystudio:// protocol, specifically when processing MCP (Model Configuration Provider) installation URLs. The application directly executes commands embedded within base64-encoded configuration data received through these URLs, without proper sanitization. An attacker could embed malicious code within a crafted URL, which, when opened by a user, would be executed on their system. This could lead to arbitrary code execution, allowing the attacker to install malware, steal sensitive data, or gain persistent access to the affected machine. The potential impact is severe, as the attacker gains full control over the system.

Users of Cherry Studio on macOS, particularly those who frequently interact with external data sources or open URLs from untrusted sources, are at significant risk. Shared hosting environments where Cherry Studio is installed could also be vulnerable, potentially impacting multiple users.

• macos / application:

ls -l /Applications/Cherry Studio.app/Contents/MacOS/Cherry Studio | grep -q 'protocol_handler'

• macos / file integrity:

md5 /Applications/Cherry Studio.app/Contents/Services/ProtocolClient.service

• macos / process monitoring:

ps aux | grep -i 'cherrystudio://'

1. 2025-10-10Disclosure

   Public Disclosure

1. 予約済み2025-10-03
2. 公開日2025-10-10
3. EPSS 更新日2026-03-23

The primary mitigation is to immediately upgrade Cherry Studio to version 1.7.1 or later, which addresses this vulnerability. If upgrading is not immediately feasible, consider blocking the cherrystudio:// protocol within your firewall or network security policies. Additionally, educate users to be cautious about opening URLs from untrusted sources, especially those using custom protocols. Monitor network traffic for suspicious cherrystudio:// URLs. After upgrading, confirm the fix by attempting to open a known malicious URL (if available) and verifying that it no longer executes arbitrary code.