PT-2025-40596 · Eidos · Eidos

Mayneyao · Published 2025-10-03 · Updated 2025-10-03 · CVE-2025-54374

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eidos versions 0.21.0 and below

Description Eidos is a framework for Personal Data Management. Versions 0.21.0 and below have a remote code execution issue. An attacker can trigger this by embedding a specially crafted eidos: URL on a website. When a victim visits the site or clicks the link, the Eidos application launches and processes the URL, resulting in remote code execution on the victim’s machine. The issue involves the application’s custom URL handler (eidos:).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-54374

GHSA-QHHM-56QP-XR2R

Affected Products

Eidos

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54374.json · Exploit
• 🔥 https://github.com/mayneyao/eidos/security/advisories/GHSA-qhhm-56qp-xr2r · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54374 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54374 · Vendor Advisory
• https://t.me/CVEtracker/34055 · Telegram Post
• https://twitter.com/CVEnew/status/1974206950624636953 · Twitter Post