CVE-2026-22793

critical · 9.6

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the renderer context. This can lead to Remote Code Execution (RCE) in environments where privileged APIs (such as Electron’s electron.mcp) are exposed, resulting in full compromise of the host system. Version 0.15.3 patches the issue.

9.6

CVSS

0.7%

EPSS (exploit prob.)

52nd

EPSS percentile

2026-01-21

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
5ire	5ire	< 0.15.3

Check a specific version with /api/v1/cve/match.

References

https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3
https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-22793