PT-2025-33844 · Deepchat · Deepchat

Jackfromeast · Published 2025-08-19 · Updated 2026-05-12 · CVE-2025-55733

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: DeepChat versions prior to 0.3.1

Description: DeepChat is a smart assistant that connects powerful AI to a user’s personal world. A remote code execution flaw exists in versions prior to 0.3.1. An attacker can exploit this issue by embedding a specially crafted deepchat: URL on a website. When a victim visits the site or clicks the link, the browser triggers the application’s custom URL handler, causing DeepChat to launch and process the URL, leading to remote code execution on the victim’s machine.

Recommendations: Update DeepChat to version 0.3.1 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-55733

GHSA-HQR4-4GFC-5P2J

Affected Products

Deepchat

References · 13

• 🔥 https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-hqr4-4gfc-5p2j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55733.json · Exploit
• https://github.com/ThinkInAIXYZ/deepchat/commit/a0ff6f362e01ddceb7fd42d0af0b28b6184fb4d2 · Patch
• https://osv.dev/vulnerability/CVE-2025-55733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55733 · Security Note
• https://t.me/CVEtracker/53430 · Telegram Post
• https://t.me/CVEtracker/30388 · Telegram Post
• https://twitter.com/0x2ed3bb60/status/2053982902929723583 · Twitter Post
• https://twitter.com/CveFindCom/status/1957875229327257601 · Twitter Post
• https://twitter.com/offseq/status/1958023839239090613 · Twitter Post
• https://twitter.com/cracbot/status/1959571457337639036 · Twitter Post
• https://t.me/cveNotify/163145 · Telegram Post
• https://twitter.com/CVEnew/status/1957877390975103290 · Twitter Post