CVE-2025-59053 AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE
Attackers can inject malicious scripts via character cards to achieve remote code execution through exposed Tauri APIs in the AIRI desktop application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-59053?
CVE-2025-59053 is a critical cross-site scripting vulnerability in moeru-ai airi, published on 11 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the `packages/stage-ui/src/components/MarkdownRenderer.vue` path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An attacker creates a card file containing malicious HTML/JavaScript, then simply processes it using the highlightTagToHtml function (which simply replaces template tags without HTML escaping), and then directly renders it using v-html, leading to cross-site scripting (XSS). The project also exposes the Tauri API, which can be called from the frontend. The MCP plugin exposes a command execution interface function in `crates/tauri-plugin-mcp/src/lib.rs`. This allows arbitrary command execution. `connect_server` directly passes the user-supplied `command` and `args` parameters to `Command::new(command).args(args)` without any input validation or whitelisting. Thus, the previous XSS exploit could achieve command execution through this interface. v0.7.2-beta.3 fixes the issue.
Weakness: CWE-94
Which versions are affected by CVE-2025-59053?
How do I fix CVE-2025-59053?
No fix has been published for CVE-2025-59053 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-59053 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59053 exists.
Sources
Also known as GHSA-9832-f8jx-hw6f.