CVE-2025-54374
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-03

Last updated on: 2025-10-24

Assigner: GitHub, Inc.

Description
Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted eidos: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (eidos:), causing the Eidos application to launch and process the URL, leading to remote code execution on the victim’s machine. This issue does not have a fix as of October 3, 2025
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-03
Last Modified
2025-10-24
Generated
2026-06-16
AI Q&A
2025-10-03
EPSS Evaluated
2026-06-15
NVD
CVE-2025-54374
EUVD
EUVD-2025-33198
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mayneyao eidos to 0.21.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Eidos versions 0.21.0 and below, where an attacker can craft a special eidos: URL and embed it on any website. When a user visits that website or clicks the link, the browser triggers the Eidos application's custom URL handler, causing the application to launch and execute the attacker's code remotely on the victim's machine.

Impact Analysis

The vulnerability allows remote code execution on the victim's machine without requiring privileges, potentially leading to full compromise of the affected system, including unauthorized access, data theft, or system damage.

Mitigation Strategies

Since there is no fix available as of October 3, 2025, immediate mitigation steps include avoiding visiting untrusted websites or clicking on suspicious eidos: URLs, disabling or restricting the Eidos application's custom URL handler if possible, and educating users about the risk of clicking on unknown links. Monitoring for any unusual application launches triggered by eidos: URLs may also help reduce risk.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-54374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart