CherryHQ cherry-studio CherryIN Preload API MemoryService authorization bypass via state manipulation

#requires -Version 5.1
# Check-CVE-2026-13534.ps1
# Detects CherryHQ cherry-studio 1.9.0 - 1.9.7 (vulnerable to CVE-2026-13534)

$ErrorActionPreference = 'SilentlyContinue'

function Get-CherryStudioVersion {
    $candidates = @(
        "$env:LOCALAPPDATA\Programs\cherry-studio\resources\app.asar",
        "$env:LOCALAPPDATA\Programs\cherry-studio\package.json",
        "$env:ProgramFiles\cherry-studio\resources\package.json"
    )
    foreach ($p in $candidates) {
        if (Test-Path $p) {
            $exe = Get-ChildItem "$env:LOCALAPPDATA\Programs\cherry-studio\Cherry Studio.exe" -ErrorAction SilentlyContinue
            if ($exe) { return $exe.VersionInfo.ProductVersion }
        }
    }
    # Fallback: registry uninstall keys
    $keys = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )
    foreach ($k in $keys) {
        $hit = Get-ItemProperty $k | Where-Object { $_.DisplayName -match 'Cherry Studio' }
        if ($hit) { return $hit.DisplayVersion }
    }
    return $null
}

$ver = Get-CherryStudioVersion
if (-not $ver) {
    Write-Output 'UNKNOWN: Cherry Studio not detected on this host'
    exit 2
}

try {
    $sv = [version]($ver -replace '[^\d\.].*$','')
} catch {
    Write-Output "UNKNOWN: could not parse version '$ver'"
    exit 2
}

$min = [version]'1.9.0'
$max = [version]'1.9.7'
if ($sv -ge $min -and $sv -le $max) {
    Write-Output "VULNERABLE: Cherry Studio $ver is in 1.9.0-1.9.7 (CVE-2026-13534)"
    exit 1
} else {
    Write-Output "PATCHED: Cherry Studio $ver is outside 1.9.0-1.9.7"
    exit 0
}