CVE-2026-22792

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe HTML rendering permits untrusted HTML (including on* event attributes) to execute in the renderer context. An attacker can inject an `<img onerror=...>` payload to run arbitrary JavaScript in the renderer, which can call exposed bridge APIs such as `window.bridge.mcpServersManager.createServer`. This enables unauthorized creation of MCP servers and lead to remote command execution. Version 0.15.3 fixes the issue.

• CWE-116

• https://github.com/nanbingxyz/5ire/releases/tag/v0.15.3Release Notes
• https://github.com/nanbingxyz/5ire/security/advisories/GHSA-p5fm-wm8g-rffxExploit, Vendor Advisory

Published

Jan 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22787html2pdf.js converts any webpage or element into a printable…6.1
• CVE-2026-22788WebErpMesv2 is a Resource Management and Manufacturing execu…8.2
• CVE-2026-22789WebErpMesv2 is a Resource Management and Manufacturing execu…8.8
• CVE-2026-2279The myLinksDump plugin for WordPress is vulnerable to SQL In…7.2
• CVE-2026-22790EVerest is an EV charging software stack. Prior to version 2…8.8
• CVE-2026-22791openCryptoki is a PKCS#11 library and tools for Linux and AI…6.1
• CVE-2026-227935ire is a cross-platform desktop artificial intelligence ass…9.6
• CVE-2026-22794Appsmith is a platform to build admin panels, internal tools…8.8
• CVE-2026-22795Issue summary: An invalid or NULL pointer dereference can ha…5.5
• CVE-2026-22796Issue summary: A type confusion vulnerability exists in the …5.3
• CVE-2026-22797An issue was discovered in OpenStack keystonemiddleware 10.5…9.9
• CVE-2026-22798hermes is an implementation of the HERMES workflow to automa…5