What is the CVSS score of EUVD-2025-201091?

EUVD-2025-201091 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Deepchat are affected by EUVD-2025-201091?

DeepChat versions 0.5.0 and earlier contain a critical vulnerability enabling attackers to execute arbitrary code on affected systems through a combination of stored XSS and Electron IPC…. A patch is available.

Is there a public PoC exploit available for EUVD-2025-201091?

Yes, a public proof-of-concept exploit is available for EUVD-2025-201091. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2025-201091?

Within 24 hours: Inventory all DeepChat deployments and identify systems running version 0.5.0 or earlier; isolate affected systems from sensitive networks if immediate patching is not feasible. Within 7 days: Apply the available vendor patch to all identified DeepChat installations and validate successful deployment. Within 30 days: Conduct a security audit to determine if the vulnerability was exploited during the exposure window and review logs for suspicious Mermaid diagram inputs or MCP server registration activities.

Deepchat EUVD-2025-201091

| CVE-2025-66222 CRITICAL

Code Injection (CWE-94)

2025-12-03 security-advisories@github.com

XSS RCE Code Injection Deepchat Thinkinai

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:14 euvd

EUVD-2025-201091

Analysis Generated

Mar 15, 2026 - 16:14 vuln.today

Patch released

Mar 15, 2026 - 16:14 nvd

Patch available

PoC Detected

Dec 05, 2025 - 15:37 vuln.today

Public exploit code

CVE Published

Dec 03, 2025 - 19:15 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC bridge, this XSS can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP (Model Context Protocol) server.

Analysis

Technical ContextAI

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication. This vulnerability is classified as Code Injection (CWE-94).

RemediationAI

A vendor patch is available — apply it immediately. Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.