Dive is an open‑source MCP Host Desktop Application that integrates with function‑calling LLMs. Before version 0.13.0 it accepts custom deeplinks that can install an attacker‑controlled MCP server configuration without sufficient user confirmation, allowing an adversary to execute arbitrary local commands on the victim’s machine. The vulnerability is a classic code injection flaw (CWE‑94) and leads to full compromise of the host device.

The affected product is OpenAgentPlatform’s Dive application, versions older than 0.13.0. No specific installation locations or operating systems are listed, but the vulnerability applies to any deployment of the desktop application that processes external deeplinks.

The CVSS score of 9.7 indicates critical severity, but the EPSS score of less than 1% suggests current exploitation attempts are unlikely. The vulnerability is not currently listed in the CISA KEV catalog, meaning no confirmed widespread attacks are known at this time. Attackers can exploit the flaw by tricking a user into clicking a crafted deeplink—most likely via malicious email or compromised website—then the application will install the attacker’s MCP server configuration and execute commands on the local machine.