Content Injection Vulnerability in 5ire AI Assistant by Nanbingxyz
CVE-2025-58357

9.7CRITICAL

Key Information:

Vendor

Nanbingxyz

Status
5ire
Vendor
CVE Published:
4 September 2025

What is CVE-2025-58357?

5ire, the cross-platform AI assistant, has a vulnerability in its version 0.13.2 that allows attackers to perform content injection attacks. This flaw is present in the chat page's script gadgets, which can be exploited through various vectors such as malicious prompt injection pages, compromised model context protocol (MCP) servers, and exploited tool integrations. Users are urged to upgrade to version 0.14.0, where this security issue has been addressed.

Affected Version(s)

5ire >= 0.13.2, < 0.14.0

References

https://github.com/nanbingxyz/5ire/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/nanbingxyz/5ire/releases/tag/v0.14.0
x_refsource_MISC

CVSS V3.1

Score:
9.7
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-58357 : Content Injection Vulnerability in 5ire AI Assistant by Nanbingxyz