PT-2026-3863 · 5Ire · 5Ire

C2An1 · Publicado 2026-01-21 · Atualizado 2026-01-22 · CVE-2026-22792

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 5ire versions prior to 0.15.3

Description 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, unsafe HTML rendering allows untrusted HTML, including on* event attributes, to execute within the renderer context. An attacker can inject an <img onerror=...> payload to execute arbitrary JavaScript in the renderer. This JavaScript can call exposed bridge APIs, such as window.bridge.mcpServersManager.createServer, potentially leading to unauthorized creation of MCP servers and remote command execution.

Recommendations Update to version 0.15.3 or later.

Exploit

Correção

RCE

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-116

Identificadores relacionados

CVE-2026-22792

GHSA-P5FM-WM8G-RFFX

Produtos afetados

5Ire

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22792.json · Exploit
• https://github.com/nanbingxyz/5ire/security/advisories/GHSA-p5fm-wm8g-rffx · Aviso do Fabricante
• https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22792 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-22792 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2014091838752223264 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2014347143746625848 · Publicação no Twitter
• https://t.me/CVEtracker/42691 · Publicação no Telegram
• https://twitter.com/0dayPublishing/status/2014083391038116225 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2014090431663878568 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2014093413688418344 · Publicação no Twitter