CVE-2025-12489
evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability
Description
evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of evernote-mcp-server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the openBrowser function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-27913.
INFO
Published Date :
Nov. 6, 2025, 9:15 p.m.
Last Modified :
Oct. 19, 2026, 1:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
Affected Products
The following products are affected by CVE-2025-12489
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.0 | HIGH | 99f1926a-a320-47d8-bbb5-42feb611262e | ||||
| CVSS 3.0 | HIGH | [email protected] |
Solution
- Validate user input before executing system calls.
- Apply vendor patches when available.
- Restrict privileges of the service account.
- Monitor system call execution.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-12489.
| URL | Resource |
|---|---|
| https://github.com/brentmid/evernote-mcp-server/commit/1e66c78c4ce6ea294ac6b0eb289a9eae9c5e9579 | |
| https://www.zerodayinitiative.com/advisories/ZDI-25-983/ |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-12489 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-12489
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-12489 vulnerability anywhere in the article.
-
Trend Micro
Introducing ÆSIR: Finding Zero-Day Vulnerabilities at the Speed of AI
Executive summary TrendAI™ has launched ÆSIR, an AI-empowered security research platform that combines advanced automation with human expertise to proactively identify and remediate zero-day vulnerabi ... Read more
The following table lists the changes that have been made to the
CVE-2025-12489 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 19, 2026
Action Type Old Value New Value Added Translation Title: evernote-mcp-server, Description: Vulnerabilidad de inyección de comandos y escalada de privilegios en openBrowser de evernote-mcp-server. Esta vulnerabilidad permite a atacantes locales escalar privilegios en instalaciones afectadas de evernote-mcp-server. Un atacante debe primero obtener la capacidad de ejecutar código con bajos privilegios en el sistema objetivo para explotar esta vulnerabilidad. La falla específica existe dentro de la función openBrowser. El problema resulta de la falta de validación adecuada de una cadena proporcionada por el usuario antes de usarla para ejecutar una llamada al sistema. Un atacante puede aprovechar esta vulnerabilidad para escalar privilegios y ejecutar código arbitrario en el contexto de la cuenta de servicio. Fue ZDI-CAN-27913. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'evernote-mcp-server', 'product': 'evernote-mcp-server', 'versions': [{'status': 'affected', 'version': '2.1.0'}], 'defaultStatus': 'unknown'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-12489', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-11-06T20:43:27.180998Z'} -
New CVE Received by [email protected]
Nov. 06, 2025
Action Type Old Value New Value Added Description evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of evernote-mcp-server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the openBrowser function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-27913. Added CVSS V3 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-78 Added Reference https://github.com/brentmid/evernote-mcp-server/commit/1e66c78c4ce6ea294ac6b0eb289a9eae9c5e9579 Added Reference https://www.zerodayinitiative.com/advisories/ZDI-25-983/