CVE-2026-22793
📋 TL;DR
CVE-2026-22793 is an unsafe option parsing vulnerability in the ECharts Markdown plugin of the 5ire AI assistant that allows arbitrary JavaScript execution in the renderer context. This can lead to remote code execution when privileged APIs like Electron's electron.mcp are exposed, potentially compromising the entire host system. Users of 5ire versions before 0.15.3 are affected.
💻 Affected Systems
- 5ire AI Assistant
📦 What is this software?
5ire by 5ire
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution leading to data theft, system takeover, and lateral movement within the network.
Likely Case
Arbitrary JavaScript execution in the renderer context, potentially accessing sensitive user data and system resources exposed to the application.
If Mitigated
Limited impact if application runs with minimal privileges and no sensitive APIs are exposed to the renderer.
🎯 Exploit Status
Exploitation requires ability to submit ECharts code blocks. The vulnerability is in option parsing that allows JavaScript execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.15.3
Vendor Advisory: https://github.com/nanbingxyz/5ire/security/advisories/GHSA-wg3x-7c26-97wj
Restart Required: Yes
Instructions:
1. Download version 0.15.3 or later from https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3
2. Install the update following platform-specific installation procedures
3. Restart the 5ire application
🔧 Temporary Workarounds
Disable ECharts Markdown Plugin
allTemporarily disable the vulnerable ECharts Markdown plugin to prevent exploitation
Check 5ire documentation for plugin management commands
Restrict User Input
allImplement input validation to block ECharts code blocks containing JavaScript
🧯 If You Can't Patch
- Run 5ire with minimal system privileges and in a sandboxed environment
- Implement network segmentation to isolate 5ire instances from critical systems
🔍 How to Verify
Check if Vulnerable:
Check 5ire version: if version is less than 0.15.3, the system is vulnerableCheck Version:
Check application settings or about dialog in 5ire interfaceVerify Fix Applied:
Verify 5ire version is 0.15.3 or higher and test that ECharts code blocks with JavaScript are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution in renderer context
- ECharts code blocks containing script tags or eval calls
Network Indicators:
- Unexpected outbound connections from 5ire process
SIEM Query:
process_name:"5ire" AND (event_type:"script_execution" OR command_line:"eval" OR command_line:"Function")