CVE-2025-58357
5ire
9.6
- Severity
- Critical
- Published
- September 4, 2025
- Last modified
- June 17, 2026
5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page's script gadgets that enables content injection attacks through multiple vectors: malicious prompt injection pages, compromised MCP servers, and exploited tool integrations. This is fixed in version 0.14.0.
CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
- CWE-79 Cross-site scripting
References
- github.comRelease Notes
- github.comExploitVendor Advisory