CVE-2025-68669 5ire vulnerable to Remote Code Execution (RCE) via mermaid
Attackers can execute arbitrary code via malicious Mermaid diagrams in the 5ire AI assistant due to loose security settings in the markdown renderer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-68669?
CVE-2025-68669 is a critical code injection vulnerability in nanbingxyz 5ire, published on 23 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE vulnerability exists in useMarkdown.ts, where the markdown-it-mermaid plugin is initialized with securityLevel: 'loose'. This configuration explicitly permits the rendering of HTML tags within Mermaid diagram nodes. This issue has not been patched at time of publication.
Weakness: CWE-79
Which versions are affected by CVE-2025-68669?
It affects 1 product.
Products include 5ire 5ire.
How do I fix CVE-2025-68669?
No fix has been published for CVE-2025-68669 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-68669 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68669 exists.
Other vulnerabilities in nanbingxyz 5ire
- CVE-2026-22792 5ire vulnerable to Remote Code Execution (RCE)
- CVE-2026-22793 5ire vulnerable to Remote Code Execution (RCE) via ECharts
- CVE-2025-58357 5ire Chat Message XSS Vulnerability Enables Remote Code Execution
- CVE-2025-47777 5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)
Sources
Also known as GHSA-5hpf-p8fw-j349.