Stored/Reflected XSS via HTML entity bypass in DeepChat SVG rendering (CVE-2026-43900)

DeepChat's SVGSanitizer uses plain-text regular expressions to strip `javascript:` protocols from SVG artifacts, but does not decode HTML entities before applying these checks. A malicious SVG containing obfuscated entity-encoded payloads (e.g., `javascript:alert(1)`) bypasses the sanitizer; when the content is injected via Vue's `v-html` directive, the browser's rendering engine decodes the entities and executes arbitrary JavaScript upon user interaction with the rendered SVG element. Affected versions: - All untracked versions up to current standard We recommend updating to: v1.0.4-beta.1. CVSS 9.3 · our assessment: act_now Reference: https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-7r59-67v3-3mgp Details: https://vuln.today/cve/CVE-2026-43900