CVEvulnerability

CVE-2025-54374

8.8 HIGH Published 2025-10-03 Modified 2026-10-08 Official page ↗
Status
Analyzed
Published
2025-10-03
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted eidos: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (eidos:), causing the Eidos application to launch and process the URL, leading to remote code execution on the victim’s machine. This issue does not have a fix as of October 3, 2025

Affected configurations

• mayneyao eidos (<= 0.21.0)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References