EUVD-2026-29337Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Remote entity-obfuscated payload needs no auth (PR:N) but requires victim interaction (UI:R); JS runs in a separate render context (S:C) with limited, unproven privileged impact (C:L/I:L).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS) vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer (src/main/lib/svgSanitizer.ts) restricts script execution by scrubbing javascript: protocols using plain-text regular expressions. However, it fails to account for HTML entity decoding prior to Vue's v-html DOM insertion inside the SvgArtifact.vue component. By feeding an SVG artifact with obfuscated entities (e.g., javascript:alert(1)), an attacker can completely bypass the sanitizer, culminating in arbitrary JavaScript execution when a victim interacts with the rendered SVG Element. This vulnerability is fixed in v1.0.4-beta.1.
AnalysisAI
Stored cross-site scripting in DeepChat before v1.0.4-beta.1 lets an attacker smuggle malicious JavaScript through SVG artifacts rendered by the SvgArtifact.vue component, achieving arbitrary script execution when a victim interacts with the rendered SVG. The flaw stems from a validation gap: the SVGSanitizer strips 'javascript:' with plain-text regex while Vue's v-html performs HTML-entity decoding afterward, so entity-obfuscated payloads (e.g. 'javascript:alert(1)') slip past. Publicly available exploit code exists (SSVC 'poc'), but there is no confirmed active exploitation and EPSS is very low at 0.04% (12th percentile).
Technical ContextAI
DeepChat is an Electron/Vue-based open-source AI agent platform (vendor thinkinaixyz) that unifies models, tools, and agents and can render model-generated artifacts, including SVG. The root cause is CWE-79 (improper neutralization of input during web page generation), manifested as a parser-differential bug: the backend sanitizer in src/main/lib/svgSanitizer.ts blocks dangerous protocols using literal-text regular expressions, but the frontend SvgArtifact.vue uses Vue's v-html directive, which decodes HTML entities during DOM insertion. Because sanitization runs on the pre-decoded string and rendering happens on the post-decoded string, an entity-encoded 'javascript:' URI is invisible to the regex yet fully active once the browser engine decodes and executes it. Affected component per CPE: cpe:2.3:a:thinkinaixyz:deepchat.
RemediationAI
Vendor-released patch: upgrade to DeepChat v1.0.4-beta.1 or later, which corrects the sanitizer/render discrepancy; see the GitHub Security Advisory at https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-7r59-67v3-3mgp. If immediate upgrade is not possible, compensating controls include disabling or blocking rendering of SVG artifacts in the client (trade-off: loss of legitimate SVG artifact display) and treating model/agent output as untrusted by not opening SVG artifacts from untrusted conversations, shared sessions, or third-party tool responses. Because the defect is entity-decoding parity, any custom workaround must sanitize AFTER HTML-entity decoding (or avoid v-html for SVG entirely) rather than adding more pre-decode regex, which would remain bypassable.
DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting
DeepChat is a smart assistant uses artificial intelligence. Rated critical severity (CVSS 9.6), this vulnerability is re
Arbitrary protocol execution leading to remote code execution affects DeepChat before v1.0.4-beta.1, an open-source AI a
DeepChat is a smart assistant that connects powerful AI to your personal world. Rated critical severity (CVSS 9.6), this
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today