CVE-2025-50505

Clash Verge Rev thru 2.2.3 forces the installation of system services(clash-verge-service) by...

7.8 HighPublic exploit

Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key functions through the unauthorized HTTP API /start_clash, allowing local users to submit arbitrary bin_path parameters and pass them directly to the service process for execution, resulting in local privilege escalation.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.24%Up 0.2 points since Oct 8, 2025

What each source reports

CVE List Score used 7.8

Record: CVE-2025-50505
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-250
Updated: 2026-11-02

EUVDEUVD-2025-32070 7.8

Record: EUVD-2025-32070
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-225v-733h-9gwv 7.8

Clash Verge Rev thru 2.2.3 forces the installation of system services(clash-verge-service) by...

Clash Verge Rev thru 2.2.3 forces the installation of system services(clash-verge-service) by default and exposes key functions through the unauthorized HTTP API /start_clash, allowing local users to submit arbitrary bin_path parameters and pass them directly to the service process for execution, resulting in local privilege escalation.

Record: GHSA-225v-733h-9gwv
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-250
Updated: 2026-11-02

NVD 7.8

Record: CVE-2025-50505
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-250
Updated: 2026-11-06

OSV 7.8

Record: CVE-2025-50505
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-07

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	a0yami/CVE-2025-50505	2025-04-26

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts	NVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-50505 is a high vulnerability (CVSS 7.8), published October 7, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. No source names a fixed version.