The issue arises from unsafe option parsing within the ECharts Markdown plugin bundled with 5ire. Any entity that can supply an ECharts code block is able to inject arbitrary JavaScript into the renderer process. The injected code runs with the privileges granted to the Electron renderer, which in many deployments includes full access to system APIs such as electron.mcp. Consequently, an attacker can execute arbitrary commands on the host, achieving full system compromise.

Affected systems are installations of the 5ire desktop application produced by the vendor nanbingxyz. The vulnerability exists in all releases prior to version 0.15.3; any user running an earlier build who can submit Markdown content that contains an ECharts block is at risk.

The CVSS score of 9.7 marks this flaw as critical, and the EPSS score of less than 1% indicates that exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalogue, but the high severity and the possibility of remote code execution make it a priority target for attackers. Exploitation requires the ability to place ECharts code in the renderer, and only systems that expose privileged APIs (e.g., Electron’s electron.mcp) provide the full blast radius. In the absence of those APIs the risk is lower, yet still significant for privileged contexts.