CVE-2025-53964
📋 TL;DR
GoldenDict 1.5.0 and 1.5.1 contain an exposed dangerous method that allows arbitrary file read and write operations when a user adds a malicious dictionary and searches for terms within it. This vulnerability affects all users of these versions who add third-party dictionaries. Attackers can craft dictionaries to exploit this flaw.
💻 Affected Systems
- GoldenDict
📦 What is this software?
Goldendict by Goldendict
Goldendict by Goldendict
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary file write leading to remote code execution, data theft, or system destruction.
Likely Case
Local file disclosure and modification, potentially leading to privilege escalation or data corruption.
If Mitigated
Limited impact if users only add trusted dictionaries from verified sources.
🎯 Exploit Status
Exploitation requires user interaction (adding dictionary and searching). Proof-of-concept code is publicly available in the GitHub reference.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.2 or later
Vendor Advisory: https://github.com/goldendict/goldendict/releases
Restart Required: Yes
Instructions:
1. Download GoldenDict 1.5.2 or later from the official GitHub releases page. 2. Uninstall the vulnerable version. 3. Install the patched version. 4. Restart the application.
🔧 Temporary Workarounds
Restrict dictionary sources
allOnly add dictionaries from trusted, verified sources. Avoid adding unknown or untrusted dictionary files.
Disable automatic dictionary loading
allConfigure GoldenDict to not automatically load new dictionaries and require manual approval.
🧯 If You Can't Patch
- Uninstall GoldenDict 1.5.0-1.5.1 and use alternative dictionary software
- Implement application whitelisting to prevent execution of GoldenDict
🔍 How to Verify
Check if Vulnerable:
Check GoldenDict version in Help → About. If version is 1.5.0 or 1.5.1, the system is vulnerable.Check Version:
goldendict --version (Linux/macOS) or check About dialog (Windows)Verify Fix Applied:
After updating, verify version is 1.5.2 or later in Help → About.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from GoldenDict process
- Addition of unfamiliar dictionary files
Network Indicators:
- Downloads of dictionary files from untrusted sources
SIEM Query:
Process:goldendict AND (FileCreate OR FileWrite) WHERE path NOT LIKE '%goldendict%'