Remote code execution bypass via Markdown links in DeepChat (CVE-2026-43899)

An incomplete fix for CVE-2025-55733 leaves DeepChat's Electron-based AI platform vulnerable to arbitrary protocol execution leading to remote code execution. While the prior patch restricted `api.openExternal()` in the renderer preload script, it failed to sanitize native Electron pop-up window handlers in `tabPresenter.ts`, which forwards URLs directly to `shell.openExternal()` without invoking the `isValidExternalUrl` security check. An attacker or compromised AI endpoint can exploit this by returning a Markdown link with a malicious protocol (e.g. `calculator://`, `bash://`) that triggers a `target="_blank"` native window interception, bypassing the intended protocol allowlist entirely. Affected versions: - All current branches up to main (Incomplete fix for CVE-2025-55733) We recommend updating to: v1.0.4-beta.1. CVSS 9.6 · our assessment: act_now Reference: https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-cp8j-jx7q-7r5f Details: https://vuln.today/cve/CVE-2026-43899