CVE-2026-40501: cherry-studio 1.2.2 through 1.9.12

CVE-2026-40501. CVSS 3.1 base score 8.8 (HIGH, Vendor/CNA). EPSS 0.00805 (percentile 0.56371), scored 24-Oct-2026.

Affected technology

cherry-studio · 1.2.2 through 1.9.12, f9c6bddae5b91cc50872c76e791105fa219d0d34 through 151853035e8e417a51559ebfc243eda98361a882
CherryHQ

Description’s affected range: versions 1.2.2 through 1.9.12, fixed in commit 1518530,

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Remote attackers can execute arbitrary code by delivering malicious JavaScript through controlled search provider content loaded into an Electron BrowserWindow configured with nodeIntegration enabled and contextIsolation disabled. Vendor/CNA’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality, integrity and availability impact as high.

Published 25-Oct-2026 01:29 UTC

CWE: CWE-829
CCR priority: 35.4 /100 (P4)
CVSS 3.1: 8.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · Vendor/CNA
EPSS: 0.00805 · percentile 0.56371 · 2026-10-24
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-40501.html