PT-2026-3863 · 5Ire · 5Ire

C2An1 · Published 2026-01-21 · Updated 2026-01-22 · CVE-2026-22792

Positive Technologies · (AI Summary)

CVSS v3.1

9.6

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 5ire versions prior to 0.15.3

Description 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, unsafe HTML rendering allows untrusted HTML, including on* event attributes, to execute within the renderer context. An attacker can inject an

<img onerror=...>

payload to execute arbitrary JavaScript in the renderer. This JavaScript can call exposed bridge APIs, such as

window.bridge.mcpServersManager.createServer

, potentially leading to unauthorized creation of MCP servers and remote command execution.

Recommendations Update to version 0.15.3 or later.

Exploit

Fix

RCE

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-22792

GHSA-P5FM-WM8G-RFFX

Affected Products

5Ire

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22792.json · Exploit
• https://github.com/nanbingxyz/5ire/security/advisories/GHSA-p5fm-wm8g-rffx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22792 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22792 · Vendor Advisory
• https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3 · Note
• https://twitter.com/TheHackerWire/status/2014093413688418344 · Twitter Post
• https://t.me/CVEtracker/42691 · Telegram Post
• https://twitter.com/pulsepatchio/status/2014347143746625848 · Twitter Post
• https://twitter.com/0dayPublishing/status/2014083391038116225 · Twitter Post
• https://twitter.com/CVEnew/status/2014091838752223264 · Twitter Post
• https://twitter.com/CveFindCom/status/2014090431663878568 · Twitter Post