CVE-2026-23523

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the victim’s machine. This vulnerability is fixed in 0.13.0.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/OpenAgentPlatform/Dive/commit/a5162ac9eff366d8ea1215b8a47139a81a55a779	Patch
https://github.com/OpenAgentPlatform/Dive/security/advisories/GHSA-pjj5-f3wm-f9m8	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openagentplatform:dive:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-16 17:15

Updated : 2026-06-17 10:21

NVD link : CVE-2026-23523

Mitre link : CVE-2026-23523

CVE.ORG link : CVE-2026-23523

JSON object : View

Products Affected

openagentplatform

dive

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-23523", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23523", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-16T16:47:10.266349Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OpenAgentPlatform", "product": "Dive", "versions": [{"status": "affected", "version": "< 0.13.0"}]}]}], "published": "2026-01-16T17:15:54.480", "references": [{"url": "https://github.com/OpenAgentPlatform/Dive/commit/a5162ac9eff366d8ea1215b8a47139a81a55a779", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenAgentPlatform/Dive/security/advisories/GHSA-pjj5-f3wm-f9m8", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the victim\u2019s machine. This vulnerability is fixed in 0.13.0."}, {"lang": "es", "value": "Dive es una aplicaci\u00f3n de escritorio de host MCP de c\u00f3digo abierto que permite la integraci\u00f3n con LLM de llamada a funciones. Antes de 0.13.0, un deeplink manipulado puede instalar una configuraci\u00f3n de servidor MCP controlada por el atacante sin suficiente confirmaci\u00f3n del usuario y puede llevar a la ejecuci\u00f3n arbitraria de comandos locales en la m\u00e1quina de la v\u00edctima. Esta vulnerabilidad se corrige en 0.13.0."}], "lastModified": "2026-06-17T10:21:43.400", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openagentplatform:dive:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CEE8F57-062C-4DA5-86AF-AE6FE89FCA12", "versionEndExcluding": "0.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}