CVE-2025-68669

Katalog CVE

CVSS 9.6 · Critical EPSS 0,47%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada 5ire. Skor CVSS 3.1 9.6 (Critical) menurut github.com.

Deskripsi (NVD)

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE vulnerability exists in useMarkdown.ts, where the markdown-it-mermaid plugin is initialized with securityLevel: 'loose'. This configuration explicitly permits the rendering of HTML tags within Mermaid diagram nodes. This issue has not been patched at time of publication.

Rincian

Terbit di NVD

23 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.6 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 39,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nanbingxyz/5ire/security/advisories/GHSA-5hpf-p8fw-j349 exploit · advisory vendor
• https://github.com/nanbingxyz/5ire/blob/c40d05a2b546094789fc727daa5383bb15034442/src/hooks/useMarkdown.ts#L156 product
• https://github.com/nanbingxyz/5ire/commit/1fbe40d0bfbfe215370d45b9af856c286d67d3f2
• https://github.com/nanbingxyz/5ire/releases/tag/v0.15.2 release notes