by Kastro
Paper/Archive/CVE-2026-22792

CVE-2026-22792

nanbingxyz 5ire — 5ire vulnerable to Remote Code Execution (RCE)

EPSS 0.9%public exploitCVSS 9.7
critical.is priorityof 100
51
CVSS 9.7 (CNA)9.7 / 10 × 3029.1Not in CISA KEV+300.0EPSS percentile 58.2.582 × 2011.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe HTML rendering permits untrusted HTML (including on* event attributes) to execute in the renderer context. An attacker can inject an `<img onerror=...>` payload to run arbitrary JavaScript in the renderer, which can call exposed bridge APIs such as `window.bridge.mcpServersManager.createServer`. This enables unauthorized creation of MCP servers and lead to remote command execution. Version 0.15.3 fixes the issue.

Affected

ProductAffectedFixed inSource
5ire< 0.15.3–CNA

Scores by source

GitHub_M (CNA)9.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/nanbingxyz/5ire/security/advisories/GHSA-p5fm-wm8g-rffxrefgithub.com/nanbingxyz/5ire/releases/tag/v0.15.3