CVE-2026-13534 Overview
CVE-2026-13534 is an authorization bypass vulnerability [CWE-285] affecting CherryHQ cherry-studio versions up to and including 1.9.7. The flaw resides in the sha256 function of src/main/services/memory/MemoryService.ts within the CherryIN Preload API component. An attacker can manipulate the state argument to bypass authorization checks. The attack can be initiated remotely, though exploitation complexity is rated high. A public exploit has been disclosed. The vendor has stated that the memory feature is planned for removal in the v2 release.
Critical Impact
Remote authorization bypass in the CherryIN Preload API allows manipulation of the state argument in the sha256 routine, undermining access control within the memory service.
Affected Products
- CherryHQ cherry-studio versions up to 1.9.7
- Component: CherryIN Preload API
- File: src/main/services/memory/MemoryService.ts
Discovery Timeline
- 2026-06-29 - CVE-2026-13534 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-13534
Vulnerability Analysis
The vulnerability is an authorization bypass classified under [CWE-285]. It affects the sha256 function inside src/main/services/memory/MemoryService.ts, which is exposed through the CherryIN Preload API in the Electron-based cherry-studio application. By supplying a manipulated state argument, an attacker circumvents the authorization logic the routine is expected to enforce.
The issue is reachable remotely, but exploitability is rated difficult due to the high attack complexity. A public exploit reference has been disclosed via VulDB, increasing the likelihood of opportunistic use against exposed instances.
Cherry-studio is a desktop AI client that stores user memory context locally. A bypass in the memory service can allow unauthorized reads or writes to persisted state, undermining the integrity and confidentiality of stored memory items. The vendor indicates the memory subsystem will be removed in the upcoming v2 release rather than receiving a direct fix in the affected line.
Root Cause
The root cause is improper authorization within the sha256 function of MemoryService.ts. The routine trusts a caller-supplied state value rather than validating it against an authoritative session or capability check. Manipulating this argument allows a request to satisfy the authorization gate without holding the required privileges.
Attack Vector
The attack vector is network-based and requires low privileges but no user interaction. An attacker interacts with the exposed preload API surface and crafts a request that supplies a controlled state argument to the sha256 handler, bypassing the intended authorization check on the memory service. See the GitHub Issue Discussion and GitHub Pull Request for technical details. No verified proof-of-concept code is reproduced here.
Detection Methods for CVE-2026-13534
Indicators of Compromise
- Unexpected invocations of the CherryIN Preload API sha256 handler with anomalous or attacker-controlled state argument values.
- Access to MemoryService operations from sessions that never completed a legitimate authorization flow.
- Unusual read or write patterns against the local cherry-studio memory store on endpoints running versions up to 1.9.7.
Detection Strategies
- Inventory endpoints running CherryHQ cherry-studio and flag any installation at or below version 1.9.7.
- Review application logs for calls into MemoryService.ts that lack a preceding authenticated session context.
- Monitor for outbound network activity from the cherry-studio process that correlates with memory read events.
Monitoring Recommendations
- Alert on process launches of cherry-studio binaries with unexpected command-line arguments or IPC payloads targeting the preload API.
- Track file modifications to the local memory data store outside of user-initiated sessions.
- Correlate endpoint telemetry with the VulDB CVE-2026-13534 advisory for updated indicators.
How to Mitigate CVE-2026-13534
Immediate Actions Required
- Identify all instances of CherryHQ cherry-studio version 1.9.7 or earlier across managed endpoints.
- Disable the memory feature within cherry-studio where it is not required by users.
- Restrict network exposure of hosts running cherry-studio to trusted networks until a fixed release is available.
Patch Information
At time of publication, no versioned patch has been released for the 1.9.x branch. The vendor states that the memory subsystem is planned for removal in the v2 release. Track the GitHub Pull Request and the main GitHub Repository for remediation updates.
Workarounds
- Disable or avoid using the memory feature in cherry-studio until v2 is available.
- Enforce network-level controls that block untrusted access to endpoints running vulnerable versions.
- Remove or replace cherry-studio in environments where authorization integrity for local AI memory data is required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
