Vulnerability · Published Jan 21, 2026 · Assigned by GitHub_M

CVE-2026-227935ire vulnerable to Remote Code Execution (RCE) via ECharts

Critical 9.7

In plain English

A critical-severity code injection in 5ire from nanbingxyz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)9.7Critical

Exploit odds (30 days)0.7%top 45.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the renderer context. This can lead to Remote Code Execution (RCE) in environments where privileged APIs (such as Electron’s electron.mcp) are exposed, resulting in full compromise of the host system. Version 0.15.3 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
nanbingxyz	5ire	< 0.15.3

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj x_refsource_CONFIRM
https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3 x_refsource_MISC