by Kastro
Paper/Archive/CVE-2025-58766

CVE-2025-58766

dyad-sh dyad — Dyad Vulnerable to Remote Code Execution via Top-level Navigation in Preview Window

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 38.4.384 × 207.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and earlier versions that allows attackers to execute arbitrary code on users' systems. The vulnerability affects the application's preview window functionality and can bypass Docker container protections. An attacker can craft web content that automatically executes when the preview loads. The malicious content can break out of the application's security boundaries and gain control of the system. This has been fixed in Dyad v0.20.0 and later.

Affected

ProductAffectedFixed inSource
dyad< 0.20.0–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/dyad-sh/dyad/security/advisories/GHSA-7fxm-c5xx-7vpqrefgithub.com/dyad-sh/dyad/commit/1c0255ab126d3b38ae9e78b17cdab9a07e5f0185refgithub.com/dyad-sh/dyad/commit/ebcf89ee6cead83a33add5ef1e19c8d4f9b4ce9b