CVE-2026-23523: 
Dive vulnerability analysis and mitigation

CVE-2026-23523 is a one-click Remote Code Execution (RCE) vulnerability in Dive, an open-source MCP Host Desktop Application for integrating function-calling LLMs. A crafted deeplink can silently install an attacker-controlled MCP server configuration without sufficient user confirmation, leading to arbitrary local command execution on the victim's machine. All versions up to and including 0.12.6 are affected; the vulnerability is fixed in version 0.13.0. It carries a CVSS v3.1 base score of 9.6 (Critical) per the GitHub Security Advisory, with a network attack vector and no privileges required (GitHub Advisory).

The root cause (CWE-94: Improper Control of Generation of Code) lies in a bypass of the frontend confirmation dialog introduced to fix a prior vulnerability (GHSA-2r34-7pgx-vvrc). The fix only triggered a confirmation modal when transport === "stdio", but the backend (dive-mcp-host) also accepts a command field for non-stdio transports (e.g., sse, websocket). When a deeplink specifies transport: "sse" along with a command field, the frontend skips the confirmation modal entirely, while the backend's _local_http_setup method calls asyncio.create_subprocess_exec() to execute the attacker-supplied command. The patch (commit a5162ac) expands the frontend check to trigger confirmation whenever command or args fields are present in the config, regardless of transport type (GitHub Advisory, Patch Commit).

Successful exploitation results in arbitrary local command execution on the victim's machine with the privileges of the Dive application process. An attacker can achieve full confidentiality, integrity, and availability compromise of the local system — including data exfiltration, file manipulation, persistence establishment, and lateral movement within the local network. Because the attack requires only a single user click on a malicious link (e.g., embedded in a webpage, email, or chat message), the barrier to exploitation is extremely low (GitHub Advisory).

A public proof-of-concept is included in the GitHub Security Advisory, demonstrating construction of a malicious dive://mcp.install deeplink with a base64-encoded JSON payload that triggers RCE when opened in a browser with Dive installed. The EPSS score is approximately 0.044%, indicating low but non-zero automated exploitation probability. No in-the-wild exploitation or threat actor attribution has been reported at this time, and the vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify targets who have Dive (≤ 0.12.6) installed on their desktop systems — users of LLM/AI tooling communities are likely candidates.
2. Craft malicious payload: Construct a JSON config object specifying transport: "sse", a benign-looking url, and a malicious command with args (e.g., a reverse shell or data exfiltration command). Base64-encode the JSON.
3. Build the deeplink: Construct a dive://mcp.install URL with name and config query parameters, e.g.:

   dive://mcp.install?name=poc&config=<base64_payload>

4. Deliver the link: Embed the deeplink in a webpage, phishing email, chat message, or QR code and trick the victim into clicking it.
5. Browser hands off to Dive: The browser prompts the user to open the Dive application (standard OS deeplink behavior); the user clicks "Allow" or "Open".
6. Frontend bypass: Because transport is set to sse (not stdio), the vulnerable frontend skips the confirmation modal and passes the config directly to the backend.
7. Backend executes command: The backend's _local_http_setup calls asyncio.create_subprocess_exec() with the attacker-supplied command and args, achieving RCE on the victim's machine (GitHub Advisory).

• Network: Outbound connections from the Dive process to unexpected external IPs or domains shortly after a deeplink is opened; DNS queries for attacker-controlled infrastructure.
• Process: Unexpected child processes spawned by the Dive application (e.g., bash, cmd.exe, curl, wget, python, open, powershell) — particularly processes not normally associated with LLM tooling.
• File System: New or modified MCP server configuration files in the Dive application data directory containing unfamiliar command or url entries; unexpected scripts or executables dropped in user-writable directories.
• Logs: Application logs showing a new MCP server installation event with a non-stdio transport type (sse, websocket) that also includes a command field; OS-level process creation logs (e.g., Windows Event ID 4688, Linux auditd) showing subprocess creation by the Dive process.
• Registry/OS: New scheduled tasks, cron jobs, or login items created by the Dive process or its child processes (GitHub Advisory).

Users should immediately upgrade Dive to version 0.13.0 or later, which expands the frontend confirmation check to trigger whenever command or args fields are present in a deeplink config, regardless of transport type. As a temporary workaround prior to patching, users should avoid clicking dive:// deeplinks from untrusted sources and review existing MCP server configurations for unauthorized entries. Organizations should also consider restricting OS-level deeplink handling for the dive:// protocol until the patch is applied (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher TonyCrane and published by the Dive maintainer (ckaznable) on January 16, 2026. Security community coverage appeared on The Hacker Wire and Infinit Security, with the latter publishing a dedicated write-up on the one-click RCE mechanism. Broader MCP ecosystem security discussions referencing this CVE emerged in February 2026, with blog posts and articles noting it as part of a growing pattern of MCP-related vulnerabilities (30+ CVEs in the MCP ecosystem). Check Point also added detection coverage via their advisory system (GitHub Advisory, Infinit Security, Dev.to MCP Analysis).