CVE-2026-22792: 
Homebrew vulnerability analysis and mitigation

CVE-2026-22792 is a Remote Code Execution (RCE) vulnerability in 5ire, a cross-platform desktop AI assistant and Model Context Protocol (MCP) client. The flaw stems from unsafe HTML rendering that permits untrusted HTML — including on* event attributes — to execute in the Electron renderer context. All versions prior to 0.15.3 are affected. It was published on January 21, 2026, with a patch released on January 20, 2026 in version 0.15.3. The vulnerability carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory, Feedly).

The root cause is improper encoding or escaping of output (CWE-116): DOMPurify fails to strip executable event attributes such as onerror, and multiple components render untrusted HTML via React's dangerouslySetInnerHTML, for example dangerouslySetInnerHTML={{ __html: render(highlight(message.prompt, keyword) || '') }}. An attacker can inject a payload like <img onerror="...malicious JS..."> into content displayed by the application, causing arbitrary JavaScript to execute in the renderer process. That JavaScript can then invoke exposed Electron bridge APIs — specifically window.bridge.mcpServersManager.createServer — to create unauthorized MCP servers and achieve remote command execution. No special privileges are required, but user interaction (viewing the malicious content) is necessary (GitHub Advisory).

Successful exploitation grants an attacker full remote code execution on the victim's desktop system running 5ire, with high impact to confidentiality, integrity, and availability. The attacker can exfiltrate sensitive data accessible to the application, manipulate system state by creating unauthorized MCP servers, and potentially pivot to other local resources or services. Because the scope is changed (Electron renderer to host OS), the blast radius extends beyond the application sandbox (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.133%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered and credited to researchers c2an1 and TonyCrane (GitHub Advisory).

1. Identify target: Locate a user running 5ire version 0.15.2 or earlier on any supported desktop platform (Windows, macOS, Linux).
2. Craft malicious payload: Construct an HTML injection payload exploiting the unsanitized dangerouslySetInnerHTML rendering, e.g., <img src=x onerror="window.bridge.mcpServersManager.createServer({...malicious config...})">.
3. Deliver payload: Inject the payload into content that 5ire will render — such as a crafted AI model response, a shared prompt, or any user-controlled input field that is displayed using the vulnerable rendering path.
4. Trigger execution: Induce the victim to open or view the content within 5ire; the onerror event fires automatically when the browser engine processes the malformed <img> tag.
5. Invoke bridge API: The injected JavaScript calls window.bridge.mcpServersManager.createServer with attacker-controlled parameters, registering a malicious MCP server.
6. Achieve RCE: The unauthorized MCP server executes attacker-specified commands on the host operating system, completing the remote code execution chain (GitHub Advisory).

• Application Logs: Unexpected calls to MCP server creation APIs logged by 5ire; error logs referencing onerror handler execution or unexpected JavaScript evaluation in the renderer.
• File System: New or unrecognized MCP server configuration files created in the 5ire application data directory; unexpected scripts or executables dropped by the 5ire process.
• Process: Unusual child processes spawned by the 5ire Electron process (e.g., cmd.exe, powershell.exe, /bin/sh, curl, wget) that are not part of normal application behavior.
• Network: Outbound connections from the 5ire process to unknown or unexpected IP addresses or domains, particularly shortly after rendering AI-generated content.

The vendor released version 0.15.3 on January 20, 2026, which fixes the unsafe HTML rendering vulnerability. Users should immediately upgrade 5ire to version 0.15.3 or later (GitHub Release). As a temporary workaround prior to patching, users should avoid opening or interacting with untrusted content, AI-generated responses from unknown sources, or shared prompts within 5ire. Additionally, monitoring for unauthorized MCP server creation and unusual process activity from the 5ire application is recommended (GitHub Advisory).

The vulnerability was covered by The Hacker Wire, which published a dedicated article on the RCE via unsafe HTML rendering (The Hacker Wire). InfinitSec also published a post highlighting the RCE risk (InfinitSec). The vulnerability was noted on Bluesky by CVE tracking accounts and indexed by multiple vulnerability aggregators including ENISA EUVD and Red Hat's CVE database, reflecting broad community awareness of the critical severity rating.