CVE-2025-66222: fallo crítico en ThinkInAIXYZ deepchat
DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.7epss 0.7%
DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC bridge, this XSS can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP (Model Context Protocol) server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Productos afectados
ThinkInAIXYZ · deepchatCVEs relacionadas — ThinkInAIXYZ deepchat
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-55733CRITICALDeepChat One-click Remote Code Execution through Custom URL HandlingEPSS 0.7%CVE-2025-67744CRITICALMermaid XSS vulnerability leads to Remote Code ExecutionEPSS 0.6%CVE-2025-58768CRITICALDeepChat's Mermaid rendering has XSS leading to RCEEPSS 0.6%CVE-2025-66481CRITICALDeepChat's Incomplete XSS Fix Allows RCE through Mermaid ContentEPSS 0.6%CVE-2026-43899CRITICALDeepChat: Incomplete Fix for CVE-2025-55733 leads to Remote Code Execution via Markdown Links bypassing `isValidExternalUrl`EPSS 0.4%CVE-2026-43900CRITICALDeepChat: Persistent DOM XSS via HTML Entity Encoding in `<antArtifact>` SVG Rendering (Bypass of `svgSanitizer.ts`)EPSS 0.4%