CVE-2026-22793

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22793", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T18:27:19.389Z", "datePublished": "2026-01-21T21:06:58.205Z", "dateUpdated": "2026-01-21T21:26:07.121Z"}, "containers": {"cna": {"title": "5ire vulnerable to Remote Code Execution (RCE) via ECharts", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.7, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj"}, {"name": "https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3"}], "affected": [{"vendor": "nanbingxyz", "product": "5ire", "versions": [{"version": "< 0.15.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:06:58.205Z"}, "descriptions": [{"lang": "en", "value": "5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the renderer context. This can lead to Remote Code Execution (RCE) in environments where privileged APIs (such as Electron\u2019s electron.mcp) are exposed, resulting in full compromise of the host system. Version 0.15.3 patches the issue."}], "source": {"advisory": "GHSA-wg3x-7c26-97wj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-21T21:25:57.800547Z", "id": "CVE-2026-22793", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T21:26:07.121Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22793", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-21T21:25:57.800547Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T21:26:04.041Z"}}], "cna": {"title": "5ire vulnerable to Remote Code Execution (RCE) via ECharts", "source": {"advisory": "GHSA-wg3x-7c26-97wj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.7, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nanbingxyz", "product": "5ire", "versions": [{"status": "affected", "version": "< 0.15.3"}]}], "references": [{"url": "https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj", "name": "https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3", "name": "https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the renderer context. This can lead to Remote Code Execution (RCE) in environments where privileged APIs (such as Electron\u2019s electron.mcp) are exposed, resulting in full compromise of the host system. Version 0.15.3 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:06:58.205Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22793", "state": "PUBLISHED", "dateUpdated": "2026-01-21T21:26:07.121Z", "dateReserved": "2026-01-09T18:27:19.389Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T21:06:58.205Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "5ire", "vendor": "nanbingxyz", "versions": [{"status": "affected", "version": "< 0.15.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:5ire:5ire:*:*:*:*:*:*:*:*", "matchCriteriaId": "E337B209-844D-4396-B279-063A15A1C0DC", "versionEndExcluding": "0.15.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the renderer context. This can lead to Remote Code Execution (RCE) in environments where privileged APIs (such as Electron\u2019s electron.mcp) are exposed, resulting in full compromise of the host system. Version 0.15.3 patches the issue."}, {"lang": "es", "value": "5ire es un asistente de escritorio multiplataforma de inteligencia artificial y cliente de protocolo de contexto de modelo. Antes de la versi\u00f3n 0.15.3, una vulnerabilidad de an\u00e1lisis de opciones insegura en el plugin de Markdown de ECharts permite a cualquier usuario capaz de enviar bloques de c\u00f3digo de ECharts ejecutar c\u00f3digo JavaScript arbitrario en el contexto del renderizador. Esto puede llevar a Ejecuci\u00f3n Remota de C\u00f3digo (RCE) en entornos donde las API privilegiadas (como electron.mcp de Electron) est\u00e1n expuestas, lo que resulta en un compromiso total del sistema anfitri\u00f3n. La versi\u00f3n 0.15.3 corrige el problema."}], "id": "CVE-2026-22793", "lastModified": "2026-06-17T10:20:26.300", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22793", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-21T21:25:57.800547Z", "version": "2.0.3"}}]}, "published": "2026-01-21T21:16:10.107", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:11:20.866300+00:00", "value": {"mitigation_remediation": ["Upgrade to version 0.15.3 or later to remove the unsafe parsing logic.", "Disable or remove the ECharts Markdown plugin if the application does not require it, thereby reducing the attack surface.", "Restrict privilege exposure in the Electron renderer by disabling electron.mcp or configuring the context bridge to expose only the minimal set of APIs required.", "Sanitize or validate incoming Markdown content to reject or escape any ECharts code blocks before rendering."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Affected systems are installations of the 5ire desktop application produced by the vendor nanbingxyz. The vulnerability exists in all releases prior to version 0.15.3; any user running an earlier build who can submit Markdown content that contains an ECharts block is at risk.", "description_and_impact": "The issue arises from unsafe option parsing within the ECharts Markdown plugin bundled with 5ire. Any entity that can supply an ECharts code block is able to inject arbitrary JavaScript into the renderer process. The injected code runs with the privileges granted to the Electron renderer, which in many deployments includes full access to system APIs such as electron.mcp. Consequently, an attacker can execute arbitrary commands on the host, achieving full system compromise.", "risk_and_exploitability": "The CVSS score of 9.7 marks this flaw as critical, and the EPSS score of less than 1% indicates that exploitation is currently rare. The vulnerability is not listed in CISA\u2019s KEV catalogue, but the high severity and the possibility of remote code execution make it a priority target for attackers. Exploitation requires the ability to place ECharts code in the renderer, and only systems that expose privileged APIs (e.g., Electron\u2019s electron.mcp) provide the full blast radius. In the absence of those APIs the risk is lower, yet still significant for privileged contexts."}}}}, "created": "2026-01-22T10:08:34.877126+00:00", "updated": "2026-04-18T04:15:05.880018+00:00", "vendors": ["nanbingxyz", "nanbingxyz$PRODUCT$5ire"]}