CVE-2026-22793

9.6 criticalEPSS 0.7%

Critical (9.6) in 5ire 5ire. EPSS 0.7% chance of exploitation in the next 30 days.

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the renderer context. This can lead to Remote Code Execution (RCE) in environments where privileged APIs (such as Electron’s electron.mcp) are exposed, resulting in full compromise of the host system. Version 0.15.3 patches the issue.

Severity

CVSS 3.1

9.6 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2026-01-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

5ire:5ire

References

https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3
https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj

Check your stack JSON