DeepChat CVE-2025-66481

Requires a victim running DeepChat version 0.5.1 or below to render attacker-supplied Mermaid diagram content inside the app; the payload uses unquoted HTML attributes combined with HTML-entity encoding to defeat the regex in MermaidArtifact.vue that strips dangerous attributes, after which it reaches electron.ipcRenderer for host RCE. No authentication is required (PR:N), but exploitation is gated on user interaction (UI:R) - the victim must open or view the malicious Mermaid content. The key limiting factors are therefore: affected version range (≤0.5.1), the need to deliver crafted content the victim will render, and the product's small user base; notably, applying the existing MermaidArtifact.vue patch does NOT mitigate it, as that patch is bypassable.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction, and the scope change (S:C) correctly reflects that an XSS in the Electron renderer escalates out of the web context into native Remote Code Execution on the victim's host via the electron.ipcRenderer interface. The POC is publicly available (per the GitHub Security Advisory reference), which materially raises near-term exploitability, and critically there is NO vendor fix at time of publication, so there is no patch-based mitigation. The description further notes that the prior security patch for MermaidArtifact.vue is bypassable, meaning even nominally updated instances may remain exposed. Signals that temper the risk: this is NOT in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was provided, so statistical exploitation probability cannot be weighed - treat the risk as 'POC-driven and unpatched' rather than 'confirmed in-the-wild.' No SSVC decision data was supplied. Net: a real, actionable priority for anyone running DeepChat ≤0.5.1, bounded mainly by the product's limited deployment footprint and the required victim interaction.

An attacker crafts a malicious Mermaid diagram using unquoted HTML attributes plus HTML-entity encoding to slip past the regex filter in MermaidArtifact.vue, then delivers it into a DeepChat conversation (e.g., via shared content or a compromised model/response). When the victim renders the diagram, the XSS fires in the Electron renderer and abuses electron.ipcRenderer to achieve Remote Code Execution on the victim's machine. A public proof-of-concept exists, and because exploitation is network-delivered with low complexity and no authentication, the only real barrier is getting the victim to view the content (UI:R).