CVE-2025-66222

Critical

Published: 03/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

DeepChat 0.5.0 and earlier has a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid diagram renderer that allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC bridge, this XSS can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP server.

Risk Assessment

The vulnerability may allow an attacker to take control of the application and the underlying system by executing malicious code. This could lead to data theft or full compromise.

Recommendation

Update DeepChat to a version newer than 0.5.0 if a patch is available. Additionally, restrict access to the IPC bridge and validate input rendered in Mermaid diagrams.

Original NVD description (English source)

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC bridge, this XSS can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP (Model Context Protocol) server.