CVE-2026-23523criticalCWE-94

CVE-2026-23523: falha crítica em OpenAgentPlatform Dive

Dive allows One-click Remote Code Execution through Deep Links for MCP Install

Publicada em

Seguir esta CVE+ Monitorar Dive

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.7epss 7.1%
Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the victim’s machine. This vulnerability is fixed in 0.13.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
OpenAgentPlatform · Dive
CVEs relacionadas — OpenAgentPlatform Dive

No mesmo produto, das mais perigosas para as menos.

CVE-2025-58176HIGHDive's improper processing of custom urls can lead to Remote Code ExecutionEPSS 10.0%CVE-2025-66580CRITICALDive has Cross-Site Scripting vulnerability that can escalate to Remote Code ExecutionEPSS 0.6%