CVE-2025-68669

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE vulnerability exists in useMarkdown.ts, where the markdown-it-mermaid plugin is initialized with securityLevel: 'loose'. This configuration explicitly permits the rendering of HTML tags within Mermaid diagram nodes. This issue has not been patched at time of publication.

• CWE-79

• https://github.com/nanbingxyz/5ire/blob/c40d05a2b546094789fc727daa5383bb15034442/src/hooks/useMarkdown.ts#L156Product
• https://github.com/nanbingxyz/5ire/commit/1fbe40d0bfbfe215370d45b9af856c286d67d3f2
• https://github.com/nanbingxyz/5ire/releases/tag/v0.15.2Release Notes
• https://github.com/nanbingxyz/5ire/security/advisories/GHSA-5hpf-p8fw-j349Exploit, Vendor Advisory
• https://github.com/nanbingxyz/5ire/security/advisories/GHSA-5hpf-p8fw-j349Exploit, Vendor Advisory

Published

Dec 23, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68663Outline is a service that allows for collaborative documenta…5.3
• CVE-2025-68664LangChain is a framework for building agents and LLM-powered…8.2
• CVE-2025-68665LangChain is a framework for building LLM-powered applicatio…9.1
• CVE-2025-68666Discourse is an open source discussion platform. In versions…6.5
• CVE-2025-68667Conduit is a chat server powered by Matrix. A vulnerability …9.9
• CVE-2025-68668n8n is an open source workflow automation platform. From ver…9.9
• CVE-2025-6867A vulnerability was found in SourceCodester Simple Company W…7.2
• CVE-2025-68670xrdp is an open source RDP server. xrdp before v0.10.5 conta…9.8
• CVE-2025-68671lakeFS is an open-source tool that transforms object storage…4.8
• CVE-2025-68675In Apache Airflow versions before 3.1.6, and 2.11.1 the prox…7.5
• CVE-2025-6868A vulnerability was found in SourceCodester Simple Company W…7.2
• CVE-2025-68686An Exposure of Sensitive Information to an Unauthorized Acto…5.9