CVE-2026-22792
CriticalSummary
5ire prior to version 0.15.3 has an unsafe HTML rendering vulnerability that allows untrusted HTML (including on* event attributes) to execute in the renderer context. An attacker can inject an <img onerror=...> payload to run arbitrary JavaScript, enabling calls to bridge APIs like window.bridge.mcpServersManager.createServer, leading to unauthorized MCP server creation and remote command execution. Version 0.15.3 fixes the issue.
Risk Assessment
An attacker can achieve remote code execution and unauthorized access to bridge functions, potentially leading to system compromise and data integrity issues.
Recommendation
Update 5ire to version 0.15.3 or later to prevent exploitation.
Original NVD description (English source)
5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe HTML rendering permits untrusted HTML (including on* event attributes) to execute in the renderer context. An attacker can inject an `<img onerror=...>` payload to run arbitrary JavaScript in the renderer, which can call exposed bridge APIs such as `window.bridge.mcpServersManager.createServer`. This enables unauthorized creation of MCP servers and lead to remote command execution. Version 0.15.3 fixes the issue.