CVE-2025-66562

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66562
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66562.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66562
Aliases
  • GHSA-qjhq-rgmr-6c3g
Published
2025-12-05T18:03:55.770Z
Modified
2026-04-02T13:02:35.884798Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
TUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts Rendering
Details

TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution (RCE) vulnerability exists in Tuui due to an unsafe Cross-Site Scripting (XSS) flaw in the Markdown rendering component. Tuui allows the execution of arbitrary JavaScript within ECharts code blocks. Combined with an exposed IPC interface that allows spawning processes, an attacker can execute arbitrary system commands on the victim's machine simply by having them view a malicious Markdown message. This vulnerability is fixed in 1.3.4.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66562.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/ai-ql/tuui

Affected ranges

Type
GIT
Repo
https://github.com/ai-ql/tuui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1b2fb4fc25713037daab5f80c4e5e3bc72abc029

Affected versions

v0.*
v0.1.0
v0.2.0
v0.3.0
v0.5.0
v0.6.0
v0.7.0
v0.7.1
v0.7.2
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.0.0-alpha
v1.0.0-beta
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.3.1
v1.3.2
v1.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66562.json"