Cherry Studio SearchService üzerinde nodeIntegration ile Kritik Uzaktan Kod Çalıştırma (RCE)

Summary

Cherry Studio's web search feature creates hidden Electron BrowserWindow instances with nodeIntegration: true and contextIsolation: false to scrape web pages for AI context. When the AI triggers a web search, URLs extracted from search engine results — including attacker-controlled pages — are loaded into these privileged windows. JavaScript on the loaded page can call require('child_process').execSync() to execute arbitrary commands on the user's machine with full desktop-user privileges.

Affected Versions

| Parameter | Detail | |---|---| | Vulnerable range | v0.9.x – v1.8.4 (latest release) and main branch at HEAD | | Introduced in | Commit f9c6bddae5 (2025-04-10) — PR #4569 | | Verified on | v1.9.1 (dev build from main at e2366b3), 2026-04-14 | | Affected providers | local-google, local-bing, local-baidu (default), searxng (when usingBrowser: true) | | Not affected | API-based providers (tavily, zhipu, exa, exa-mcp, bocha, querit) — these do not use BrowserWindow |

Note: Only SearchService.ts sets nodeIntegration: true. All other BrowserWindow instances in the codebase correctly use nodeIntegration: false.

Impact

• Full remote code execution as the desktop user on macOS, Windows, or Linux
• Silent execution — the BrowserWindow is hidden (show: false), providing zero visual indication
• Credential theft — SSH keys, AWS credentials, browser cookies, API tokens, environment variables
• Persistent access — attacker can install cron jobs or scheduled tasks
• Supply chain risk — if a developer is compromised, code signing keys and CI/CD tokens are exposed

PoC

An attacker hosts a malicious page with SEO optimization. When the AI searches for a related query, the search engine returns the attacker's page. The LocalSearchProvider extracts the URL and loads it in a hidden BrowserWindow with nodeIntegration: true.

The page JavaScript executes require('child_process').execSync(...), gaining full RCE.

Patches

Not yet patched.

Recommended fix — disable nodeIntegration in SearchService

This is the primary fix and must be applied regardless of other mitigations:

 // src/main/services/SearchService.ts
 private async createNewSearchWindow(uid: string, show: boolean = false): Promise<BrowserWindow> {
     const newWindow = new BrowserWindow({
       width: 1280,
       height: 768,
       show,
       webPreferences: {
-        nodeIntegration: true,
-        contextIsolation: false,
+        nodeIntegration: false,
+        contextIsolation: true,
+        sandbox: true,
         devTools: is.dev
       }
     })

Workarounds

Until the patch is applied, users can switch to an API-based search provider (Tavily, Exa, etc.) or disable web search entirely.