CVE-2025-68669 – 5ire vulnerable to Remote Code Execution (RCE) via mermaid

CVE ID : CVE-2025-68669

Published : Dec. 23, 2025, 11:15 p.m. | 5 hours, 5 minutes ago

Description : 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE vulnerability exists in useMarkdown.ts, where the markdown-it-mermaid plugin is initialized with securityLevel: ‘loose’. This configuration explicitly permits the rendering of HTML tags within Mermaid diagram nodes. This issue has not been patched at time of publication.

Severity: 9.6 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…