CVE-2025-54374

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-03

Last updated on: 2025-10-24

Assigner: GitHub, Inc.

Description

Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted eidos: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (eidos:), causing the Eidos application to launch and process the URL, leading to remote code execution on the victim’s machine. This issue does not have a fix as of October 3, 2025

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-03

Last Modified

2025-10-24

Generated

2026-07-06

AI Q&A

2025-10-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-54374

EUVD

EUVD-2025-33198

Affected Vendors & Products

Vendor	Product	Version / Range
mayneyao	eidos	to 0.21.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Eidos versions 0.21.0 and below, where an attacker can craft a special eidos: URL and embed it on any website. When a user visits that website or clicks the link, the browser triggers the Eidos application's custom URL handler, causing the application to launch and execute the attacker's code remotely on the victim's machine.

Impact Analysis

The vulnerability allows remote code execution on the victim's machine without requiring privileges, potentially leading to full compromise of the affected system, including unauthorized access, data theft, or system damage.

Mitigation Strategies

Since there is no fix available as of October 3, 2025, immediate mitigation steps include avoiding visiting untrusted websites or clicking on suspicious eidos: URLs, disabling or restricting the Eidos application's custom URL handler if possible, and educating users about the risk of clicking on unknown links. Monitoring for any unusual application launches triggered by eidos: URLs may also help reduce risk.

Hi! I’m here to help you understand CVE-2025-54374. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70