https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-22793.htmlhttps://patchthecve.com/cve/CVE-2026-22793.htmlWed, 17 Jun 2026 10:20:26 +0000CRITICAL 9.6: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the rendererhttps://patchthecve.com/cve/CVE-2026-22792.htmlhttps://patchthecve.com/cve/CVE-2026-22792.htmlWed, 17 Jun 2026 10:20:26 +0000CRITICAL 9.6: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe HTML rendering permits untrusted HTML (including on* event attributes) to execute in the renderer context. An attacker can inject an `<img onerror=...>` payload tohttps://patchthecve.com/cve/CVE-2025-68669.htmlhttps://patchthecve.com/cve/CVE-2025-68669.htmlMon, 19 Oct 2026 22:10:00 +0000CRITICAL 9.6: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. In versions 0.15.2 and prior, an RCE vulnerability exists in useMarkdown.ts, where the markdown-it-mermaid plugin is initialized with securityLevel: 'loose'. This configuration explicitly permits thhttps://patchthecve.com/cve/CVE-2025-58357.htmlhttps://patchthecve.com/cve/CVE-2025-58357.htmlWed, 17 Jun 2026 09:44:21 +0000CRITICAL 9.6: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page's script gadgets that enables content injection attacks through multiple vectors: malicious prompt injection pages, compromised MCP servers, https://patchthecve.com/cve/CVE-2025-47777.htmlhttps://patchthecve.com/cve/CVE-2025-47777.htmlWed, 17 Jun 2026 09:28:40 +0000CRITICAL 9.6: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerable to stored cross-site scripting in chatbot responses due to insufficient sanitization. This, in turn, can lead to Remote Code Execution (RCE) via unsafe Electr