CVE-2025-58766

Executive Summary

CVE-2025-58766 is a critical security vulnerability in Dyad, a local AI app builder, affecting versions 0.19.0 and earlier. The flaw resides in the application's preview window functionality, allowing an attacker to execute arbitrary code on a user's system by crafting malicious web content that automatically executes when the preview loads. This vulnerability can bypass Docker container protections, enabling an attacker to break out of the application's security boundaries and gain full control of the system. The CVSS score is 9.1 (Critical), and the vulnerability has been patched in Dyad v0.20.0. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is high due to the potential for remote code execution (RCE) and container escape.

Supply Chain & Package Security

Dyad is a local AI app builder, likely distributed as a binary or via package managers. The vulnerability is in the application's core functionality, not in a specific package registry (NPM, PyPI, Go, Ruby). However, users should verify the integrity of their Dyad installation and ensure they are using the latest patched version (v0.20.0+). Supply chain risks include downloading Dyad from unofficial sources or using outdated versions that may be compromised.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must load the malicious preview.
• Scope (S): Changed – The vulnerability can affect resources beyond the application's security boundaries (container escape).
• Confidentiality (C): High – Full system compromise possible.
• Integrity (I): High – Attacker can modify system files.
• Impact (H): High – Complete system takeover.

Threat Level: Critical. The vulnerability allows arbitrary code execution and container escape, making it a high-priority target for attackers.

Deep Dive & Mechanics

The vulnerability exists in Dyad's preview window functionality, which is used to render web content (e.g., HTML, JavaScript) within the application. The preview window likely uses a WebView or similar component to display user-provided content. Due to insufficient input sanitization and improper security configuration, an attacker can inject malicious JavaScript or HTML that executes when the preview loads.

The key issue is that the preview window does not properly isolate the rendered content from the host system. This allows the injected code to:

1. Execute arbitrary system commands via Node.js integration or similar APIs.
2. Break out of Docker container protections by exploiting shared resources or misconfigured container settings.

The attack flow:

1. Attacker crafts a malicious web page or payload (e.g., HTML with embedded JavaScript).
2. Victim opens the payload in Dyad's preview window (e.g., by opening a project file or clicking a link).
3. The malicious code executes, gaining access to the host system.
4. Attacker can then execute arbitrary commands, exfiltrate data, or install malware.

The vulnerability is fixed in Dyad v0.20.0 by implementing proper input sanitization, disabling dangerous APIs in the preview window, and enforcing stricter container isolation.

Vulnerable vs. Patched Code

Vulnerable Code (Dyad v0.19.0 and earlier):

// Example of vulnerable preview window setup
const { BrowserWindow } = require('electron');
let previewWindow = new BrowserWindow({
  webPreferences: {
    nodeIntegration: true, // Dangerous: allows Node.js access
    contextIsolation: false, // Dangerous: allows direct access to Electron APIs
    preload: null
  }
});
previewWindow.loadURL('data:text/html,' + encodeURIComponent(userInput));

Patched Code (Dyad v0.20.0 and later):

// Example of patched preview window setup
const { BrowserWindow } = require('electron');
let previewWindow = new BrowserWindow({
  webPreferences: {
    nodeIntegration: false, // Disabled: prevents Node.js access
    contextIsolation: true, // Enabled: isolates renderer process
    preload: path.join(__dirname, 'preload.js') // Use a secure preload script
  }
});
previewWindow.loadURL('data:text/html,' + encodeURIComponent(sanitizedInput));

The patched version disables Node.js integration, enables context isolation, and uses a secure preload script to limit the renderer's capabilities. Additionally, input is sanitized to prevent injection of malicious code.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install Dyad v0.19.0 on a test system (e.g., a virtual machine).
2. Create a malicious HTML file with the following payload:

<html>
<body>
<script>
// Exploit code to execute arbitrary commands
const { exec } = require('child_process');
exec('calc.exe', (error, stdout, stderr) => {
  // Command executed on host system
});
</script>
</body>
</html>

3. Open the malicious file in Dyad's preview window (e.g., by loading it as a project).
4. The payload executes, launching calc.exe (or any other command) on the host system.

Container Escape: If Dyad is running inside a Docker container, the attacker can break out by:

• Mounting the host filesystem: docker run -v /:/host ...
• Using the --privileged flag or sharing the Docker socket.
• Exploiting the vulnerability to execute commands that access the host.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual child processes spawned by Dyad (e.g., calc.exe, cmd.exe, powershell.exe).
• Look for network connections from Dyad to unknown IPs.
• Check for file modifications in sensitive directories (e.g., /etc, C:\Windows).

Response:

1. Isolate the affected system from the network.
2. Terminate the Dyad process.
3. Scan for malware or persistence mechanisms.
4. Upgrade Dyad to v0.20.0 or later.
5. Review logs for indicators of compromise.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but users should verify Dyad binary integrity)
• Network Indicators:
  • Outbound connections from Dyad to unknown IPs on ports 80/443.
  • DNS queries to suspicious domains.
• Process Indicators:
  • Dyad spawning unexpected child processes (e.g., cmd.exe, powershell.exe, bash).
  • High CPU or memory usage by Dyad.
• File System Indicators:
  • Unusual files in Dyad's installation directory.
  • Modifications to system files (e.g., /etc/passwd, C:\Windows\System32).
• Registry/Config Changes:
  • New startup entries or scheduled tasks created by Dyad.

Detection Engineering

YARA Rule

rule CVE_2025_58766_Dyad_RCE {
  meta:
    description = "Detects malicious HTML/JS payloads targeting Dyad preview window"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-58766"
  strings:
    $s1 = "nodeIntegration" nocase
    $s2 = "contextIsolation" nocase
    $s3 = "previewWindow" nocase
    $s4 = "exec(" nocase
    $s5 = "child_process" nocase
  condition:
    any of ($s1, $s2, $s3) and any of ($s4, $s5)
}

Sigma Rule

title: CVE-2025-58766 - Dyad RCE via Preview Window
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2025-58766 in Dyad
author: Valters IT
date: 2025-04-10
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\Dyad.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\calc.exe'
      - '\bash.exe'
  condition: selection
falsepositives:
  - Legitimate use of Dyad with external tools
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58766 - Dyad RCE via Preview Window"; flow:to_server,established; content:"Dyad"; http_user_agent; content:"preview"; http_uri; pcre:"/(nodeIntegration|contextIsolation|exec\(|child_process)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Dyad to v0.20.0 or later immediately.
2. If upgrade is not possible, disable the preview window functionality or restrict its use to trusted content only.
3. Run Dyad in a sandboxed environment (e.g., a virtual machine) to limit the impact of exploitation.

Long-term Mitigations:

• Implement strict input validation and sanitization for all user-provided content.
• Use secure WebView configurations (disable Node.js integration, enable context isolation).
• Regularly update Dyad and all dependencies.
• Monitor for suspicious activity using the provided detection rules.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions or support, contact info@valtersit.com.