Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted eidos: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (eidos:), causing the Eidos application to launch and process the URL, leading to remote code execution on the victim’s machine. This issue does not have a fix as of October 3, 2025
References
| Link | Resource |
|---|---|
| https://github.com/mayneyao/eidos/security/advisories/GHSA-qhhm-56qp-xr2r | Exploit Vendor Advisory |
| https://github.com/mayneyao/eidos/security/advisories/GHSA-qhhm-56qp-xr2r | Exploit Vendor Advisory |
Configurations
History
10 Oct 2025, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/mayneyao/eidos/security/advisories/GHSA-qhhm-56qp-xr2r - Exploit, Vendor Advisory | |
| First Time |
Mayneyao edios
Mayneyao |
|
| CPE | cpe:2.3:a:mayneyao:edios:*:*:*:*:*:node.js:*:* |
03 Oct 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/mayneyao/eidos/security/advisories/GHSA-qhhm-56qp-xr2r - |
03 Oct 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-03 20:15
Updated : 2025-10-10 16:32
NVD link : CVE-2025-54374
Mitre link : CVE-2025-54374
CVE.ORG link : CVE-2025-54374
JSON object : View
Products Affected
mayneyao
- edios
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')