A Single Click Can Hijack Your PC: CVE-2025-58176 RCE Flaw Found in Dive Desktop App

3 September 2025: The Open Agent Platform has issued a security advisory warning of a critical vulnerability in its Dive desktop application, tracked as CVE-2025-58176 (CVSS 8.8), with remote code execution risks triggered through a maliciously crafted custom URL.

According to the Open Agent Platform advisory, a one-click RCE in the latest Dive version (v0.9.3) can be triggered from a custom URL in the form of dive:_; attackers can exploit the issue by redirecting a victim from a malicious site to a crafted dive:// link or embedding the link in legitimate sites or user-generated content.

When the victim’s browser processes the dive:// handler, the Dive application is launched and the crafted URL leads to arbitrary code execution on the machine, with the config parameters that may include installation commands for MCP servers. The advisory notes that the vulnerability exists in the most up-to-date Dive (v0.9.3) and has been fixed in Dive version 0.9.4, with users strongly urged to upgrade immediately. Given its one-click nature and the PoC potential, the flaw poses a serious risk, particularly in phishing or social engineering campaigns.