Vulnerability · Published Dec 23, 2025 · Assigned by GitHub_M

CVE-2025-686695ire vulnerable to Remote Code Execution (RCE) via mermaid

Critical 9.7

In plain English

A critical-severity cross-site scripting in 5ire from nanbingxyz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)9.7Critical

Exploit odds (30 days)0.5%top 58.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE vulnerability exists in useMarkdown.ts, where the markdown-it-mermaid plugin is initialized with securityLevel: 'loose'. This configuration explicitly permits the rendering of HTML tags within Mermaid diagram nodes. This issue has not been patched at time of publication.

Affected products (as reported)

Vendor	Product	Versions
nanbingxyz	5ire	<= 0.15.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/nanbingxyz/5ire/security/advisories/GHSA-5hpf-p8fw-j349 x_refsource_CONFIRM
https://github.com/nanbingxyz/5ire/commit/1fbe40d0bfbfe215370d45b9af856c286d67d3f2 x_refsource_MISC
https://github.com/nanbingxyz/5ire/blob/c40d05a2b546094789fc727daa5383bb15034442/src/hooks/useMarkdown.ts#L156 x_refsource_MISC
https://github.com/nanbingxyz/5ire/releases/tag/v0.15.2 x_refsource_MISC