5ire Client vulnerable to XSS and RCE in versions before 0.11.1
The 5ire Client software had critical security vulnerabilities in versions before 0.11.1 that allowed stored cross-site scripting attacks via unsanitized chatbot responses and remote code execution through unsafe Electron protocol handling. The vulnerabilities were patched in version 0.11.1 with enhanced input sanitization and protocol restrictions.
What happened
5ire Client versions prior to 0.11.1 contained stored cross-site scripting (XSS) vulnerabilities due to insufficient sanitization of chatbot responses, allowing attackers to inject malicious HTML and JavaScript.
The client was also vulnerable to remote code execution (RCE) through unsafe Electron protocol handling and exposed Electron APIs, including globally accessible window.electron.openExternal and ipcRenderer functions.
Reported impact
Attackers could inject malicious payloads into chatbot responses that would execute arbitrary JavaScript on user systems.
XSS vulnerabilities could escalate to remote code execution by exploiting unsafe Electron configurations (e.g., file:///, smb:// protocol support) and exposed APIs, potentially enabling system-level compromise and launching of native applications.
Index analysis
The vulnerability required network access and no user privileges, but did require user interaction. Attack complexity was low.
With a CVSS score of 9.6 (critical), the vulnerability affected confidentiality, integrity, and availability across the Electron application scope.
Governance controls
Patches were released in version 0.11.1, which implemented DOMPurify sanitization in markdown rendering and restricted the open-external IPC handler to allow only http:, https:, and mailto: protocols.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.