CVE-2025-66580: 
Dive vulnerability analysis and mitigation

CVE-2025-66580 is a critical Stored Cross-Site Scripting (XSS) vulnerability in Dive, an open-source MCP Host Desktop Application by OpenAgentPlatform, that can escalate to Remote Code Execution (RCE). The flaw exists in the Mermaid diagram rendering component in all versions prior to 0.11.1 (≤ v0.11.0). It was published on December 19, 2025, with a fix released in version 0.11.1. The vulnerability carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is the insecure configuration of the Mermaid diagram library using securityLevel: 'loose', which permits javascript: protocol URIs in click interaction definitions (CWE-94: Improper Control of Code Generation; CWE-79: Cross-Site Scripting). An attacker crafts a Mermaid diagram containing a node with a click event that triggers a javascript: URI payload; when the victim clicks the node, the injected JavaScript executes within the application context. The payload leverages the application's internal API proxy via fetch() to send a POST request to /api/config/mcpserver, overwriting the MCP server configuration with a malicious command (e.g., calc), which the backend then executes. This attack requires no authentication and no special privileges — only a single user interaction (clicking the malicious node) (GitHub Advisory).

Successful exploitation results in Remote Code Execution on the victim's machine with HIGH impact on confidentiality, integrity, and availability. An attacker can overwrite the MCP server configuration to register and execute arbitrary system commands, potentially enabling full system compromise, data exfiltration, installation of malware, or lateral movement within the victim's environment. The scope change (S:C) in the CVSS score reflects that the impact extends beyond the Dive application itself to the underlying operating system (GitHub Advisory, Feedly).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, demonstrating the exact Mermaid diagram payload required to trigger RCE. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.00166 (low probability of near-term exploitation), and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is network-accessible with low complexity and no required privileges, making it straightforward for remote unauthenticated attackers to weaponize (GitHub Advisory, Feedly).

1. Reconnaissance: Identify targets using Dive (openagentplatform/dive) versions ≤ 0.11.0, particularly users who interact with AI-generated or shared Mermaid diagrams within the application.
2. Craft malicious Mermaid diagram: Construct a Mermaid graph containing a clickable node with a javascript: URI payload in the click directive, for example:

graph TD
  A[Click me]
  click A "javascript:fetch('/api/config/mcpserver',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({mcpServers:{test:{transport:'stdio',command:'calc'}}})})"

3. Deliver the payload: Inject the malicious Mermaid diagram into the victim's Dive session — for example, by prompting the integrated LLM to generate the diagram, sharing a configuration, or through any input channel that renders Mermaid content in the application.
4. Wait for user interaction: The payload is stored and rendered in the Mermaid component. When the victim clicks the malicious node (e.g., labeled 'Click me'), the javascript: URI executes in the application context due to securityLevel: 'loose'.
5. MCP server configuration overwrite: The injected JavaScript sends a POST request to /api/config/mcpserver via the application's internal API proxy, registering a new MCP server entry with a malicious command value.
6. Achieve RCE: The Dive backend processes the new MCP server configuration and executes the attacker-specified command (e.g., calc on Windows, or any arbitrary shell command), resulting in code execution on the victim's machine (GitHub Advisory).

• Network: Unexpected POST requests to /api/config/mcpserver originating from the Dive application process, especially with unusual or newly registered MCP server entries containing unfamiliar command values.
• File System: Modifications to the Dive MCP server configuration file reflecting newly added or altered server entries with suspicious commands (e.g., system binaries, reverse shell commands, or unexpected executables).
• Process: Unexpected child processes spawned by the Dive backend service (e.g., calc.exe, cmd.exe, bash, powershell, curl, or other binaries not normally launched by Dive).
• Logs: Application logs showing POST requests to /api/config/mcpserver with JSON bodies containing unfamiliar mcpServers entries; Mermaid rendering events followed immediately by API configuration changes (GitHub Advisory).

The vendor has released Dive version 0.11.1, which fixes this vulnerability by addressing the insecure Mermaid securityLevel: 'loose' configuration. All users running Dive ≤ 0.11.0 should upgrade to version 0.11.1 or later immediately. As interim mitigations: restrict or disable Dive usage in environments handling sensitive data until patched; educate users to avoid clicking nodes in diagrams generated from untrusted or unknown sources; and monitor for suspicious MCP server configuration changes and unexpected process execution from the Dive backend (GitHub Advisory, Red Hat CVE).

The vulnerability was noted by The Hacker Wire, which published a brief report highlighting the critical RCE-via-XSS chain in the Dive MCP Host Desktop Application. Security community members on Mastodon (infosec.exchange) and Bluesky shared the advisory shortly after publication. The CISA weekly vulnerability bulletin for the week of December 15, 2025 included reference to this CVE. A later blog post on dev.to discussed CVE-2025-66580 in the context of MCP's expanding attack surface, noting the similarity to CVE-2025-58768 (The Hacker Wire, CISA Bulletin).