Nanbingxyz 5Ire vulnerabilities

CVE-2026-22793 [CRITICAL] CWE-94 CVE-2026-22793: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the renderer context. This can lead to Remote Code Execution (

CVE-2026-22792 [CRITICAL] CWE-116 CVE-2026-22792: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe HTML rendering permits untrusted HTML (including on* event attributes) to execute in the renderer context. An attacker can inject an `` payload to run arbitrary JavaScript in the renderer, which can call exposed

CVE-2025-68669 [CRITICAL] CWE-79 CVE-2025-68669: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE vulnerability exists in useMarkdown.ts, where the markdown-it-mermaid plugin is initialized with securityLevel: 'loose'. This configuration explicitly permits the rendering of HTML tags within Mermaid diagram no

CVE-2025-47777 [CRITICAL] CWE-20 CVE-2025-47777: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerable to stored cross-site scripting in chatbot responses due to insufficient sanitization. This, in turn, can lead to Remote Code Execution (RCE) via unsafe Electron protocol handling and exposed Electron APIs. Al

CVE-2025-58357 [CRITICAL] CWE-79 CVE-2025-58357: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page's script gadgets that enables content injection attacks through multiple vectors: malicious prompt injection pages, compromised MCP servers, and exploited tool integrations. This is fixed in