VYPR
← All advisories
High severity8.8NVD Advisory· Published Oct 3, 2025· Updated Jun 17, 2026

CVE-2025-54374

CVE-2025-54374

Description

Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted eidos: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (eidos:), causing the Eidos application to launch and process the URL, leading to remote code execution on the victim’s machine. This issue does not have a fix as of October 3, 2025

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Mayneyao/eidos3 versions
    cpe:2.3:a:mayneyao:eidos:*:*:*:*:*:node.js:*:*+ 2 more
    • cpe:2.3:a:mayneyao:eidos:*:*:*:*:*:node.js:*:*range: <=0.21.0
    • (no CPE)range: <=0.21.0
    • (no CPE)range: <= 0.21.0
  • Eidos/Eidosllm-create
    Range: <=0.21.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.