Cherry Studio includes a SearchService that loads content from search providers into an Electron BrowserWindow with nodeIntegration enabled and contextIsolation disabled. This configuration allows malicious JavaScript injected by a compromised search engine or result page to run with full Node.js privileges, giving the attacker access to filesystem APIs, child process execution, operating‑system calls, and environment variables under the Cherry Studio process account. The weakness is a CWE‑829 external resource manipulation, enabling attackers to execute arbitrary code.

Version 1.2.2 through 1.9.12 of CherryHQ:cherry-studio are affected. All installations using these releases deploy the vulnerable SearchService and are susceptible to the described remote code execution flaw.

The CVSS score of 8.6 indicates high severity. EPSS is less than 1 %, suggesting that exploitation attempts are unlikely. Attackers must control a search provider, individual result pages, or provider settings pages to inject malicious JavaScript. Once injected, the compromised BrowserWindow runs the code with full Node.js privileges, enabling arbitrary system command execution under the Cherry Studio process account.