PT-2025-49418 · Tykodev · Cherry-Studio-Tykofork

Yhryhryhr_Miemie · Published 2025-12-07 · Updated 2025-12-07 · CVE-2025-14204

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TykoDev cherry-studio-TykoFork version 0.1

Description A flaw exists in the OAuth Server Discovery component of the software, specifically within the redirectToAuthorization function located in the file /.well-known/oauth-authorization-server. Manipulation of the authorizationUrl argument can lead to operating system command injection. This issue is remotely exploitable, and details of the exploit have been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-14204

Affected Products

Cherry-Studio-Tykofork

References · 6

• 🔥 https://lavender-bicycle-a5a.notion.site/TokyoTech-RCE-26153a41781f80b6a370d427a6d307f0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14204 · Security Note
• https://t.me/cveNotify/145042 · Telegram Post
• https://vuldb.com/?ctiid.334647 · Note
• https://vuldb.com/?id.334647 · Note
• https://vuldb.com/?submit.700182 · Note