CVE-2026-40501

Deferred Deferred - Pending Action

Remote Code Execution in Cherry Studio via SearchService

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: VulnCheck

Description

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScript through controlled search provider content loaded into an Electron BrowserWindow configured with nodeIntegration enabled and contextIsolation disabled. Attackers who control a search engine provider, individual search result pages, or provider settings pages can execute JavaScript with full Node.js privileges, gaining access to fs, child_process, os, and process.env under the operating-system account of the Cherry Studio process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-40501

EUVD

EUVD-2026-44747

Affected Vendors & Products

Vendor	Product	Version / Range
cherry_studio	cherry_studio	From 1.2.2 (inc) to 1.9.12 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

CVE-2026-40501 is a remote code execution vulnerability in Cherry Studio versions 1.2.2 through 1.9.12. It exists due to a misconfiguration in the Electron BrowserWindow where nodeIntegration is enabled and contextIsolation is disabled. This allows attackers who control search provider content to execute arbitrary JavaScript with full Node.js privileges, gaining access to system resources like file system, child processes, and environment variables.

Detection Guidance

Check if Cherry Studio versions 1.2.2 through 1.9.12 are installed by running version checks or inspecting installed applications. Verify if Electron BrowserWindow is configured with nodeIntegration enabled and contextIsolation disabled in the application's source code or configuration files.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system with the same privileges as the Cherry Studio application. This means they can access sensitive data like files, environment variables, and system information. Attackers could also install malware, modify or delete files, or perform other malicious actions under your user account.

Compliance Impact

This vulnerability could lead to severe compliance violations. Unauthorized code execution may result in unauthorized access to or disclosure of sensitive personal data, violating GDPR's data protection requirements. For HIPAA, it could expose protected health information to unauthorized parties, leading to significant legal and financial penalties.

Mitigation Strategies

Update Cherry Studio to the latest version beyond 1.9.12 where the vulnerability is fixed. Alternatively, disable nodeIntegration in Electron BrowserWindow or enable contextIsolation to prevent JavaScript from accessing Node.js APIs.

Hi! I’m here to help you understand CVE-2026-40501. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70