CVE-2025-68669

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-68669

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68669.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-68669

Aliases

GHSA-5hpf-p8fw-j349

Published

2025-12-23T22:51:35.848Z

Modified

2026-02-07T21:35:34.835305Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

5ire vulnerable to Remote Code Execution (RCE) via mermaid

Details

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE vulnerability exists in useMarkdown.ts, where the markdown-it-mermaid plugin is initialized with securityLevel: 'loose'. This configuration explicitly permits the rendering of HTML tags within Mermaid diagram nodes. This issue has not been patched at time of publication.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68669.json"
}

References

Affected packages

Git / github.com/nanbingxyz/5ire

Affected ranges

Type: GIT
Repo: https://github.com/nanbingxyz/5ire
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

c40d05a2b546094789fc727daa5383bb15034442

Affected versions

v0.*

v0.10.0

v0.10.1

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.12.0

v0.12.1

v0.13.0

v0.13.1

v0.13.2

v0.14.0

v0.14.1

v0.15.0

v0.15.1

v0.7.9

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68669.json"