CVE-2025-66222: DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid…

PriorityP347critical9.6CVSS 3.1

AVNACLPRNUIRSCCHIHAH

EPSS

0.51%

39.5th percentile

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC bridge, this XSS can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP (Model Context Protocol) server.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
thinkinai	deepchat	<= 0.5.0	—
thinkinaixyz	deepchat	< 0.5.0	0.5.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.