CVE-2026-22792
5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe HTML rendering permits untrusted HTML (including on* event attributes) to execute in the renderer context. An attacker can inject an `<img onerror=...>` payload to run arbitrary JavaScript in the renderer, which can call exposed bridge APIs such as `window.bridge.mcpServersManager.createServer`. This enables unauthorized creation of MCP servers and lead to remote command execution. Version 0.15.3 fixes the issue.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS probability
- 0.74%
- CWE
- CWE-116
- Published
- 2026-01-21
- Last modified
- 2026-03-12
Affected products
- nanbingxyz 5ire
Weakness type
Related vulnerabilities
- CVE-2026-88921 — MISP: Unescaped HTML Injection in PDF Report Element Rendering
- CVE-2026-54694 — NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- CVE-2026-79964 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-79952 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-87550 — Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a...
- CVE-2026-69821 — Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability
- CVE-2026-82756 — ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
- CVE-2026-52772 — YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)