CVE-2026-40501 is a remote code execution vulnerability affecting Cherry Studio versions 1.2.2 through 1.9.12. The vulnerability arises from the SearchService loading search provider content into an Electron BrowserWindow configured insecurely with nodeIntegration enabled and contextIsolation disabled. Attackers controlling a search engine provider, search result pages, or provider settings can inject malicious JavaScript that executes with full Node.js privileges, allowing access to sensitive Node.js modules such as fs, child_process, os, and process.env. This enables execution of arbitrary code under the OS account of the Cherry Studio process. The vulnerability is fixed in commit 1518530, but no official patch or advisory details are provided in the input data.

Successful exploitation allows remote attackers to execute arbitrary code with full Node.js privileges on the host running Cherry Studio. This includes access to filesystem operations, process control, environment variables, and other OS-level capabilities, potentially leading to full system compromise under the affected user account.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit 1518530, so applying the update containing this commit is recommended once available. Until patched, avoid using untrusted search providers or content within Cherry Studio and consider disabling nodeIntegration or enabling contextIsolation in Electron BrowserWindow configurations if configurable.