CVE-2025-66580

Critical

Published: 19/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Dive is an open-source MCP Host Desktop Application. A critical Stored XSS vulnerability exists in versions prior to 0.11.1 in the Mermaid diagram rendering component. The application allows execution of arbitrary JavaScript via `javascript:`. An attacker can inject a malicious MCP server configuration, leading to RCE on the victim's machine when the node is clicked. Version 0.11.1 fixes the issue.

Risk Assessment

Risk of remote code execution on the victim's machine, potentially leading to full system compromise and data theft.

Recommendation

Immediately update Dive to version 0.11.1 or later and avoid opening untrusted MCP configurations.

Original NVD description (English source)

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting (XSS) vulnerability exists in versions prior to 0.11.1 in the Mermaid diagram rendering component. The application allows the execution of arbitrary JavaScript via `javascript:`. An attacker can exploit this to inject a malicious Model Context Protocol (MCP) server configuration, leading to Remote Code Execution (RCE) on the victim's machine when the node is clicked. Version 0.11.1 fixes the issue.