CVE-2025-66580 CRITICAL

CVE-2025-66580: Dive has Cross-Site Scripting vulnerability that can escalate to Remote Code Execution

Vendor Openagentplatform
Product Dive
Weakness CWE-94 · Code injection
Published December 19, 2025
Last update December 19, 2025
View on NVD All CVEs

CVSS base score

9.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting (XSS) vulnerability exists in versions prior to 0.11.1 in the Mermaid diagram rendering component. The application allows the execution of arbitrary JavaScript via `javascript:`. An attacker can exploit this to inject a malicious Model Context Protocol (MCP) server configuration, leading to Remote Code Execution (RCE) on the victim's machine when the node is clicked. Version 0.11.1 fixes the issue.

Key dates

02Disclosure timeline

December 19, 2025 CVE published
December 19, 2025 Record updated