CVE-2025-66222

CRITICAL

DeepChat < 0.5.0 - Stored Cross-Site Scripting and Remote Code Execution via Mermaid Diagram Renderer

Title source: llm
STIX 2.1

Description

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC bridge, this XSS can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP (Model Context Protocol) server.

References (2)

Core 2

Scores

CVSS v3 9.6
EPSS 0.0051
EPSS Percentile 39.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
thinkinai/deepchat < 0.5.0
Published Dec 03, 2025
Tracked Since Feb 18, 2026