A critical Remote Code Execution vulnerability in 5ire allows attackers to execute arbitrary code by exploiting improper security configurations in the markdown-it-mermaid plugin.

The vulnerability exists within the useMarkdown.ts file, where the markdown-it-mermaid plugin is initialized with a 'loose' security level. This configuration fails to sanitize input, permitting the rendering of malicious HTML tags within Mermaid diagram nodes, ultimately leading to RCE.

The CVSS score of 9.6 highlights the extreme danger of this vulnerability, which allows an attacker to execute arbitrary code on the host machine. This can lead to total system compromise, theft of sensitive AI model data, and unauthorized access to the user's local environment.

Immediate Action: As no patch is currently available, restrict the use of 5ire in sensitive environments and avoid processing untrusted Markdown files.

Proactive Monitoring: Monitor system logs for unexpected process execution or anomalous network activity originating from the 5ire application.

Compensating Controls: Utilize endpoint detection and response (EDR) solutions to flag and block suspicious child processes spawned by the 5ire application.

Public Exploit Available: Unknown

This is an unpatched critical vulnerability. Organizations should treat this as a high-priority risk and restrict the application's access to internal networks or sensitive data until a security update is released by the vendor.