Vulnerability details
CVE-2026-22793
nanbingxyz 5ire
5ire vulnerable to Remote Code Execution (RCE) via ECharts
CVSS 3.1
9.7Critical
Official description
5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the renderer context. This can lead to Remote Code Execution (RCE) in environments where privileged APIs (such as Electron’s electron.mcp) are exposed, resulting in full compromise of the host system. Version 0.15.3 patches the issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.7Critical | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| nanbingxyz | 5ire | < 0.15.3 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj x_refsource_CONFIRM
- https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-01-22
- Last updated
- 2026-01-22
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.72%
Probability of exploitation in 30 days
54.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')