PT-2025-49303 · Tuui · Tuui

Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-66562

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TUUI versions prior to 1.3.4

Description TUUI is a desktop MCP client designed as a tool unitary utility integration. A critical Remote Code Execution (RCE) issue exists due to an unsafe Cross-Site Scripting (XSS) flaw in the Markdown rendering component. TUUI allows the execution of arbitrary JavaScript within ECharts code blocks. Combined with an exposed IPC interface that allows spawning processes, an attacker can execute arbitrary system commands on a victim’s machine by having them view a malicious Markdown message. The vulnerable component is the Markdown rendering component, specifically when processing ECharts code blocks.

Recommendations Versions prior to 1.3.4 should be updated to version 1.3.4 or later.

Exploit

Fix

RCE

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-66562

GHSA-QJHQ-RGMR-6C3G

Affected Products

Tuui

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66562.json · Exploit
• https://github.com/AI-QL/tuui/security/advisories/GHSA-qjhq-rgmr-6c3g · Vendor Advisory
• https://github.com/AI-QL/tuui/commit/f673fa5b4d76e8236c7d9506d0727875cfa79cc1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66562 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66562 · Vendor Advisory
• https://github.com/AI-QL/tuui/releases/tag/v1.3.4 · Note
• https://t.me/CVEtracker/38955 · Telegram Post