PT-2025-35861 · 5Ire · 5Ire

Jackfromeast · CVE-2025-58357 · Published 2025-09-04 · Updated 2026-05-23

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 5ire versions prior to 0.14.0

Description 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. A flaw in the chat page's script gadgets allows content injection attacks. This can be achieved through several vectors, including malicious prompt injection pages, compromised MCP servers, and exploited tool integrations.

Recommendations Update to version 0.14.0.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-58357

GHSA-8527-3CCH-95GF

Affected Products

5Ire

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58357.json · Exploit
• https://github.com/nanbingxyz/5ire/security/advisories/GHSA-8527-3cch-95gf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58357 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58357 · Vendor Advisory
• https://github.com/nanbingxyz/5ire/releases/tag/v0.14.0 · Note
• https://twitter.com/CveFindCom/status/1965009955473203333 · Twitter Post
• https://twitter.com/HugoValters/status/2058069666304856505 · Twitter Post