CVE-2025-50505 is a local privilege escalation vulnerability found in Clash Verge versions through 2.2.3. Clash Verge installs a system service named clash-verge-service by default, which exposes an HTTP API endpoint `/start_clash` without proper authorization controls. This endpoint accepts a parameter called bin_path, which specifies a binary executable path. Due to insufficient input validation and lack of authentication, local users can submit arbitrary bin_path values that the service will execute with elevated privileges. This flaw arises from CWE-250 (Execution with Unnecessary Privileges), allowing attackers to escalate from limited user accounts to higher privilege levels on the host system. The vulnerability has a CVSS 3.1 base score of 7.8, reflecting high impact on confidentiality, integrity, and availability. Exploitation requires local access but no user interaction or complex attack vectors. The issue was addressed in Clash Verge version 2.3.0 by removing or securing the exposed API and restricting execution parameters. No known public exploits have been reported yet, but the vulnerability poses a significant risk to any system running vulnerable versions, especially in environments where multiple users have local access.

The vulnerability enables local attackers to execute arbitrary code with elevated privileges, potentially leading to full system compromise. This can result in unauthorized access to sensitive data, modification or deletion of critical files, installation of persistent malware, and disruption of system availability. In multi-user or shared environments, this flaw could allow a low-privileged user to gain administrative control, undermining system security and trust. Organizations relying on Clash Verge for network or security functions may face operational disruptions and increased risk of lateral movement by attackers. The lack of authentication on the API endpoint increases the attack surface for insider threats or compromised local accounts. Although no exploits are currently known in the wild, the vulnerability’s high severity and ease of exploitation make it a critical concern for affected users.

1. Upgrade Clash Verge to version 2.3.0 or later, where the vulnerability is fixed. 2. If immediate upgrade is not possible, restrict local access to systems running vulnerable versions to trusted users only. 3. Use host-based firewalls or access control mechanisms to block or limit access to the clash-verge-service HTTP API endpoint locally. 4. Monitor system logs for unusual invocations of the `/start_clash` API or unexpected execution of binaries. 5. Employ application whitelisting to prevent unauthorized binaries from executing with elevated privileges. 6. Conduct regular audits of installed services and their exposed interfaces to detect unauthorized or insecure configurations. 7. Educate users about the risks of local privilege escalation and enforce the principle of least privilege to minimize potential damage from compromised accounts.