ZeroDay Findings
Sign inSign up

Findings

CVE-2025-14204

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1.

Published Dec 7, 2025 · updated Oct 14, 2026

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 7, 2025 · NIST NVD

    Detected

    A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

  2. Oct 14, 2026 · NIST NVD

    Updated

    A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Sources

  • CVE.orgVulnerability recordCVE-2025-14204

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-14204

    30-day exploitation probability 1.3%

    first.org
  • NIST NVDVulnerability recordCVE-2025-14204

    A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to o

    nvd.nist.gov

References