CVE-2026-23523
📋 TL;DR
This vulnerability in the Dive MCP Host Desktop Application allows attackers to install malicious MCP server configurations via crafted deeplinks without proper user confirmation, leading to arbitrary command execution on the victim's machine. All users running Dive versions before 0.13.0 are affected. The vulnerability enables full system compromise through local command execution.
💻 Affected Systems
- Dive MCP Host Desktop Application
📦 What is this software?
Dive by Openagentplatform
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining full control over the victim's machine, data exfiltration, ransomware deployment, and persistent backdoor installation.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive files, credential theft, and lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation and user privilege restrictions, potentially containing damage to isolated systems.
🎯 Exploit Status
Exploitation requires user interaction with a malicious deeplink but no authentication. The vulnerability is straightforward to exploit once the deeplink is triggered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.13.0
Vendor Advisory: https://github.com/OpenAgentPlatform/Dive/security/advisories/GHSA-pjj5-f3wm-f9m8
Restart Required: Yes
Instructions:
1. Download Dive version 0.13.0 or later from the official repository. 2. Uninstall the vulnerable version. 3. Install the patched version. 4. Restart the application.
🔧 Temporary Workarounds
Disable deeplink handling
allPrevent Dive from handling deeplinks to block the attack vector
On Windows: Remove Dive from default applications for URL protocols
On macOS: Use RCDefaultApp or similar to change default handlers
On Linux: Modify .desktop files to remove MIME type associations
Network isolation
allRestrict network access to prevent malicious deeplink delivery
Configure firewall rules to block unnecessary inbound/outbound connections to Dive
🧯 If You Can't Patch
- Run Dive with minimal user privileges to limit potential damage from command execution
- Implement application whitelisting to prevent unauthorized binary execution
🔍 How to Verify
Check if Vulnerable:
Check Dive version in application settings or via command line: dive --versionCheck Version:
dive --versionVerify Fix Applied:
Confirm version is 0.13.0 or higher using: dive --version📡 Detection & Monitoring
Log Indicators:
- Unexpected MCP server configuration changes
- Unusual process execution from Dive context
- Deeplink activation logs with suspicious URLs
Network Indicators:
- Outbound connections to unknown MCP servers
- Unusual network traffic patterns from Dive process
SIEM Query:
process_name:"dive" AND (event_type:"process_creation" OR event_type:"registry_modification")