CVE-2025-68669

Published December 23rd, 2025

View on NVD ↗

CVSS v3

9.6

CRITICAL

CVSS v2

N/A

Affected

PROJECT

Description

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE vulnerability exists in useMarkdown.ts, where the markdown-it-mermaid plugin is initialized with securityLevel: 'loose'. This configuration explicitly permits the rendering of HTML tags within Mermaid diagram nodes. This issue has not been patched at time of publication.

nanbingxyz/5ire

5ire is a cross-platform desktop AI assistant, MCP client. It compatible with major service providers, supports local knowledge base and tools via model context protocol servers .

GitHub

5.24K