Description

TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution (RCE) vulnerability exists in Tuui due to an unsafe Cross-Site Scripting (XSS) flaw in the Markdown rendering component. Tuui allows the execution of arbitrary JavaScript within ECharts code blocks. Combined with an exposed IPC interface that allows spawning processes, an attacker can execute arbitrary system commands on the victim's machine simply by having them view a malicious Markdown message. This vulnerability is fixed in 1.3.4.

INFO

Published Date :

2025-12-05T18:03:55.770Z

Last Modified :

2025-12-05T18:29:59.430Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-66562 vulnerability.

Vendors Products
Ai-ql
  • Tuui
Aiql
  • Tuui
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-66562.

URL Resource
https://github.com/AI-QL/tuui/commit/f673fa5b4d76e8236c7d9506d0727875cfa79cc1 cve-icon cve-icon
https://github.com/AI-QL/tuui/releases/tag/v1.3.4 cve-icon cve-icon
https://github.com/AI-QL/tuui/security/advisories/GHSA-qjhq-rgmr-6c3g cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact