Cherry Studio versions 1.2.2 through 1.9.12 are affected by a remote code execution vulnerability in the SearchService. The issue arises because the application loads search provider content into an Electron BrowserWindow configured with nodeIntegration enabled and contextIsolation disabled, allowing malicious JavaScript delivered via a compromised or attacker-controlled search provider to execute with full Node.js privileges. This enables attackers to access sensitive Node.js modules such as fs, child_process, os, and process.env, potentially compromising the host system under the user account running Cherry Studio. The vulnerability is fixed in commit 1518530, but no official patch or advisory details are currently provided.

Successful exploitation allows remote attackers to execute arbitrary code with full Node.js privileges on the affected system under the operating system account running Cherry Studio. This can lead to full system compromise, including file system access, process execution, and environment variable disclosure. The vulnerability does not require privileges or user interaction beyond visiting or loading malicious search provider content. The CVSS 4.0 score of 8.6 reflects high impact and exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using untrusted or unknown search providers within Cherry Studio and consider disabling nodeIntegration or enabling contextIsolation in the Electron BrowserWindow configuration if possible. Monitor vendor channels for updates and apply the fix once available (noted as commit 1518530).