What is the CVSS score of CVE-2026-43899?

CVE-2026-43899 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of DeepChat are affected by CVE-2026-43899?

DeepChat, an open-source AI agent desktop platform used for enterprise AI interactions, is vulnerable to remote code execution via malicious chat messages; publicly available exploit code exists.. A patch is available.

How to fix or mitigate CVE-2026-43899?

Within 24 hours: immediately discontinue or restrict DeepChat usage to isolated environments and create an inventory of all affected systems and users; communicate to users to avoid clicking links from untrusted chat sources. Within 7 days: deploy patch version v1.0.4-beta.1 across all instances and verify successful patching; monitor endpoint logs for suspicious process executions and protocol handler invocations. Within 30 days: confirm all systems are running patched version v1.0.4-beta.1, conduct security awareness training on chat-based attack vectors, and implement endpoint detection rules to alert on exploitation attempts.

DeepChat CVE-2026-43899

EUVD-2026-29336 CRITICAL

Improper Input Validation (CWE-20)

2026-05-11 GitHub_M

Authentication Bypass Deepchat

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Attacker-supplied link is delivered network-side with no privileges but needs the chat to render/user to trigger it (UI:R); escaping the renderer to the OS shell is a scope change with full code-execution impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:29 vuln.today

Patch available

May 11, 2026 - 23:03 EUVD

CVE Published

May 11, 2026 - 21:42 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass (RCE). While the patch correctly restricted api.openExternal() inside the renderer's preload/index.ts script, it structurally neglected to sanitize native Electron pop-up window handlers. An attacker or a compromised AI endpoint returning a Markdown link can trigger a target="_blank" native window interception in tabPresenter.ts, which forwards the malicious URL directly to shell.openExternal(url) and completely bypasses the isValidExternalUrl security boundary. This vulnerability is fixed in v1.0.4-beta.1.

AnalysisAI

Arbitrary protocol execution leading to remote code execution affects DeepChat before v1.0.4-beta.1, an open-source AI agent desktop platform built on Electron. The prior fix for CVE-2025-55733 only hardened api.openExternal() in the renderer preload but left native Electron pop-up window handlers unguarded, so a Markdown link with target="_blank" - deliverable by an attacker or a compromised/malicious AI endpoint the user is chatting with - is intercepted in tabPresenter.ts and passed straight to shell.openExternal(url), bypassing the isValidExternalUrl allowlist. Publicly available exploit code exists (SSVC: poc) but there is no public exploit identified in CISA KEV; EPSS is low at 0.07% (22th percentile).

Technical ContextAI

DeepChat is an Electron application, which combines a Chromium renderer with Node.js/OS-level capabilities. The vulnerable pattern is Electron's shell.openExternal(), which hands a URL to the host operating system's protocol handler; if an attacker controls the URL scheme, they can invoke dangerous handlers (e.g. file:, custom app protocols, or OS-registered handlers) that can result in code execution. CWE-20 (Improper Input Validation) is the root cause: the isValidExternalUrl security boundary was applied to one code path (the renderer preload's api.openExternal) but not to the native window-open interception path in tabPresenter.ts, so target="_blank" links routed through Electron's setWindowOpenHandler / new-window flow reached shell.openExternal unvalidated. Per CPE cpe:2.3:a:thinkinaixyz:deepchat, the affected product is ThinkInAIXYZ DeepChat across all versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade to DeepChat v1.0.4-beta.1 or later, which extends the isValidExternalUrl validation to the native Electron window-open handler path in tabPresenter.ts; see the advisory at https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-cp8j-jx7q-7r5f. Because the earlier CVE-2025-55733 patch is insufficient, do not rely on any pre-v1.0.4-beta.1 build. Until the upgrade is applied, reduce risk by connecting DeepChat only to trusted model endpoints (a compromised or malicious AI endpoint is a viable delivery channel), and instruct users not to click links returned in chat, especially those opening new windows - trade-off is degraded usability of legitimate links. Organizations that build from source can also apply a compensating control by hardening the OS protocol-handler registrations (removing or restricting dangerous custom URL scheme handlers) so that even an unvalidated shell.openExternal call cannot reach a code-execution handler, at the cost of breaking those protocol integrations.