PT-2025-38242 · Dyad · Dyad

Jackfromeast · Published 2025-09-17 · Updated 2025-09-18 · CVE-2025-58766

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dyad versions prior to 0.20.0

Description Dyad is a local AI app builder susceptible to arbitrary code execution on users' systems. The issue affects the application’s preview window functionality and can bypass Docker container protections. An attacker can craft web content that automatically executes when the preview loads, potentially gaining control of the system.

Recommendations Update to Dyad version 0.20.0 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-00216

CVE-2025-58766

GHSA-7FXM-C5XX-7VPQ

Affected Products

Dyad

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58766.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-58766 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00216 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58766 · Security Note
• https://github.com/dyad-sh/dyad/security/advisories/GHSA-7fxm-c5xx-7vpq · Note
• https://github.com/dyad-sh/dyad/commit/1c0255ab126d3b38ae9e78b17cdab9a07e5f0185 · Note
• https://github.com/dyad-sh/dyad/commit/ebcf89ee6cead83a33add5ef1e19c8d4f9b4ce9b · Note
• https://twitter.com/CVEnew/status/1968561230995472745 · Twitter Post
• https://twitter.com/CveFindCom/status/1968376822162165834 · Twitter Post