PT-2026-3261 · Dive · Dive

Tonycrane · Publicado 2026-01-16 · Atualizado 2026-02-09 · CVE-2026-23523

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dive versions prior to 0.13.0

Description Dive is an open-source MCP Host Desktop Application that integrates with function-calling LLMs. A crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation, potentially leading to arbitrary local command execution on the victim’s machine. The vulnerability is related to the handling of deeplinks and the installation of MCP server configurations.

Recommendations Update Dive to version 0.13.0 or later.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-23523

GHSA-PJJ5-F3WM-F9M8

Produtos afetados

Dive

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23523.json · Exploit
• https://github.com/OpenAgentPlatform/Dive/security/advisories/GHSA-pjj5-f3wm-f9m8 · Aviso do Fabricante
• https://github.com/OpenAgentPlatform/Dive/commit/a5162ac9eff366d8ea1215b8a47139a81a55a779 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-23523 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-23523 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2012212394702020704 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2012207248022392865 · Publicação no Twitter
• https://t.me/cveNotify/151475 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2012218083675443646 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2012238250442727737 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2012303240554234354 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2012531446054015341 · Publicação no Twitter