Two Critical Flaws Uncovered in Wondershare RepairIt Exposing User Data and AI Models

Cybersecurity researchers have disclosed two critical flaws in Wondershare RepairIt that could expose private user data and enable AI model tampering and supply chain risks. The flaws, CVE-2025-10643 (CVSS 9.1) and CVE-2025-10644 (CVSS 9.4), are authentication bypass vulnerabilities tied to permissions granted to a storage account token and an SAS token, respectively, and could allow attackers to bypass authentication and launch a supply chain attack.

According to Trend Micro, the AI-powered data repair and photo editing app reportedly collected and stored private user data due to weak DevSecOps practices, with tokens embedded directly in code and data stored without encryption. The exposed cloud storage reportedly contained user data, AI models, software binaries, container images, scripts, and company source code, enabling potential tampering with AI models or executables and broader supply chain abuse.

Trend Micro disclosed the issues through the Zero Day Initiative in April 2025, and urged users to restrict interaction with the product until fixes are available. The disclosure highlights risks from inadequate secure development and the importance of robust security in AI-enabled tools.