CVE-2025-66562: TUUI is a desktop MCP client designed as a tool unitary utility integration

Q: How do I fix CVE-2025-66562?

tuui: upgrade to 1.3.4. Exact commands for each OS are on this page.

Q: Is CVE-2025-66562 being exploited?

CVE-2025-66562 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2025-66562 affect?

CVE-2025-66562 affects tuui. Severity is critical (CVSS 9.6). TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution (RCE) vulnerability exists in Tuui due to an unsafe Cross-Site Scripting (XSS) flaw in the Markdown rendering comp

Q: How urgent is CVE-2025-66562?

Priority 45/100. Critical severity

This month

CRITICAL 9.6UPGRADE

CVE-2025-66562 is a critical-severity flaw (CVSS 9.6) affecting tuui. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution (RCE) vulnerability exists in Tuui due to an unsafe Cross-Site Scripting (XSS) flaw in the Markdown rendering component. Tuui allows the execution of arbitrary JavaScript within ECharts code blocks. Combined with an exposed IPC interface that allows spawning processes, an attacker can execute arbitrary system commands on t

Why this priority

Critical severity

A fixed release or distro patch exists.

Risk facts

CVSS score	9.6 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.5% (top 56%)
CISA exploited list	No
Weakness	CWE-79, CWE-94
Published	2025-12-05
Last modified	2026-09-25

Publisher (CNA): GitHub, Inc. · Vendor: aiql

Last updated 2026-09-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-12-05 18:15 UTCPublished CVE record published
2026-09-25 23:10 UTCUpdated Record last modified

aiql tuui UPGRADE

Affected: < 1.3.4

Fixed in: 1.3.4

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy tuui || rpm -q tuui || tuui --version

2. UPGRADE to 1.3.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade tuui

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade tuui

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-66562?

tuui: upgrade to 1.3.4. Exact commands for each OS are on this page.

Is CVE-2025-66562 being exploited?

CVE-2025-66562 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-66562 affect?

CVE-2025-66562 affects tuui. Severity is critical (CVSS 9.6). TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution (RCE) vulnerability exists in Tuui due to an unsafe Cross-Site Scripting (XSS) flaw in the Markdown rendering comp

How urgent is CVE-2025-66562?

Priority 45/100. Critical severity

References

← Back to latest CVEs