PT-2026-60237 · Unknown · Cherry-Studio

Hanyin · Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-40501

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cherry Studio versions 1.2.2 through 1.9.12

Description A remote code execution issue exists in the SearchService. Remote attackers can execute arbitrary code by delivering malicious JavaScript through controlled search provider content. This occurs when content is loaded into an Electron BrowserWindow configured with nodeIntegration enabled and contextIsolation disabled. Attackers controlling a search engine provider, individual search result pages, or provider settings pages can execute JavaScript with full Node.js privileges, granting access to fs, child process, os, and process.env under the operating-system account of the Cherry Studio process.

Recommendations Update Cherry Studio versions 1.2.2 through 1.9.12 to the version containing commit 1518530.

Exploit

Fix

RCE

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-40501

Affected Products

Cherry-Studio

References · 6

• 🔥 https://gist.github.com/Mundi-Xu/99af1b08275fd437cfb79bfe481e68b7 · Exploit
• https://github.com/CherryHQ/cherry-studio/commit/151853035e8e417a51559ebfc243eda98361a882 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40501 · Security Note
• https://twitter.com/CVEnew/status/2077469484764598534 · Twitter Post
• https://twitter.com/infoflowcloud/status/2077470960844718236 · Twitter Post
• https://vulncheck.com/advisories/cherry-studio-rce-via-searchservice-nodeintegration-misconfiguration · Note