PT-2026-3864 · 5Ire · 5Ire+1

C2An1 · Publicado 2026-01-21 · Atualizado 2026-01-22 · CVE-2026-22793

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 5ire versions prior to 0.15.3

Description 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. A flaw in the ECharts Markdown plugin allows any user capable of submitting ECharts code blocks to execute arbitrary JavaScript code within the renderer context. This can lead to Remote Code Execution (RCE) in environments where privileged APIs are accessible, potentially resulting in full compromise of the host system. The issue stems from an unsafe option parsing mechanism within the ECharts Markdown plugin.

Recommendations Update to version 0.15.3 to address the issue.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-22793

GHSA-WG3X-7C26-97WJ

Produtos afetados

5Ire

Echarts Markdown Plugin

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22793.json · Exploit
• https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj · Aviso do Fabricante
• https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22793 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2014093362945729023 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2014090405768290420 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2014345893256855866 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014091837720449284 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-22793 · Aviso do Fabricante
• https://t.me/CVEtracker/42692 · Publicação no Telegram
• https://twitter.com/0dayPublishing/status/2014087155925086498 · Publicação no Twitter