CVE-2025-47777

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerable to stored cross-site scripting in chatbot responses due to insufficient sanitization. This, in turn, can lead to Remote Code Execution (RCE) via unsafe Electron protocol handling and exposed Electron APIs. All users of 5ire client versions prior to patched releases, particularly those interacting with untrusted chatbots or pasting external content, are affected. Version 0.11.1 contains a patch for the issue.

• CWE-20
• CWE-79

• https://github.com/nanbingxyz/5ire/commit/56601e012095194a4be0d4cb6da6b5b3cb53dea8Patch
• https://github.com/nanbingxyz/5ire/security/advisories/GHSA-mr8w-mmvv-6hq8Vendor Advisory
• https://positive.security/blog/url-open-rceNot Applicable
• https://shabarkin.notion.site/1-click-RCE-in-Electron-Applications-501c2e96e7934610979cd3c72e844a22Not Applicable
• https://www.electronjs.org/docs/latest/tutorial/securityNot Applicable
• https://www.youtube.com/watch?v=ROFYhS9E9eUExploit

Published

May 14, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-47770Rejected reason: Not used
• CVE-2025-47771PowSyBl (Power System Blocks) is a framework to build power …8.1
• CVE-2025-47773Combodo iTop is a web based IT service management tool. Vers…6.1
• CVE-2025-47774Vyper is the Pythonic Programming Language for the Ethereum …2.9
• CVE-2025-47775Bullfrog is a GithHb Action to block unauthorized outbound t…8.6
• CVE-2025-47776Mantis Bug Tracker (MantisBT) is an open source issue tracke…9.1
• CVE-2025-47778Sulu is an open-source PHP content management system based o…6.1
• CVE-2025-47779Asterisk is an open-source private branch exchange (PBX). Pr…6.5
• CVE-2025-4778A vulnerability was found in PHPGurukul Park Ticketing Manag…8.8
• CVE-2025-47780Asterisk is an open-source private branch exchange (PBX). Pr…7.8
• CVE-2025-47781Rallly is an open-source scheduling and collaboration tool. …9.8
• CVE-2025-47782motionEye is an online interface for the software motion, a …8.9