PT-2025-52494 · Dive · Dive

C2An1 · CVE-2025-66580 · Published 2025-12-19 · Updated 2026-01-02

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dive versions prior to 0.11.1

Description Dive is an open-source MCP Host Desktop Application that integrates with function-calling LLMs. A critical Stored Cross-Site Scripting (XSS) issue exists in the Mermaid diagram rendering component. The application permits the execution of arbitrary JavaScript via javascript:. An attacker can exploit this to inject a malicious Model Context Protocol (MCP) server configuration, potentially leading to Remote Code Execution (RCE) on the victim's machine when a node is clicked. The vulnerable component allows for the injection of malicious code through the javascript: URI scheme.

Recommendations Update to version 0.11.1 to resolve this issue.

Exploit

Fix

RCE

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-66580

GHSA-XV8M-365J-X6H2

Affected Products

Dive

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66580.json · Exploit
• 🔥 https://github.com/OpenAgentPlatform/Dive/security/advisories/GHSA-xv8m-365j-x6h2 · Exploit
• https://osv.dev/vulnerability/CVE-2025-66580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66580 · Security Note
• https://t.me/CVEtracker/40293 · Telegram Post
• https://twitter.com/0dayPublishing/status/2002056471421337659 · Twitter Post
• https://twitter.com/CVEnew/status/2002099136179699886 · Twitter Post
• https://t.me/cveNotify/147584 · Telegram Post
• https://twitter.com/CveFindCom/status/2002071201762386407 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002212563392590111 · Twitter Post
• https://twitter.com/TheHackerWire/status/2002066095235289316 · Twitter Post
• https://twitter.com/grok/status/2002963189630226553 · Twitter Post