Deep Chat CVE-2026-108852

Exploitation requires that the application embedding Deep Chat (through version 2.5.1) render attacker-influenced Markdown - specifically content delivered via AI responses, the addMessage API, or loaded conversation history - because RemarkableConfig.createNew turns off Remarkable's built-in link scheme validation, permitting javascript: URIs by default. The decisive limiting factor is user interaction: the victim must actively click the malicious link (UI:A) for the script to fire; the link does not auto-execute. A second practical prerequisite (AT:P) is that the attacker must first get crafted Markdown into the chat stream, which typically means control over the AI backend, the ability to supply history, or a reflection path for user content. No authentication is required of the attacker (PR:N), and the insecure configuration is the component's default behavior rather than an opt-in setting.

This is a genuinely low-priority issue despite being a real XSS flaw. The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A) scores only 2.1, and the signals are internally consistent: network-reachable but requires active user interaction (the victim must click a crafted link) and an attack requirement (AT:P) that the attacker first get malicious Markdown into the chat stream. Impact is confined to the subsequent/embedding page (VC:N/VI:N/VA:N with SC:L/SI:L), i.e. script execution in the page context rather than compromise of the Deep Chat component's own data. No KEV listing and no confirmed public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - though a detailed third-party technical writeup (hackmd) and a VulnCheck advisory exist and could lower the effort to reproduce. No EPSS score or SSVC decision data was supplied, so probability-of-exploitation and automatability cannot be weighed. The realistic risk is a targeted client-side attack dependent on an attacker already controlling or influencing message/history content, not a mass-exploitable server flaw.

An attacker who can influence content rendered by Deep Chat - for example a malicious or compromised AI backend, user-supplied chat history, or any text passed to addMessage - embeds a Markdown link using the javascript: scheme. Because RemarkableConfig.createNew disables Remarkable's link validation, the link is rendered intact; when the victim clicks it, arbitrary JavaScript executes in the context of the embedding page. No public exploit code is identified, but a third-party technical writeup documenting the flaw is referenced.