PT-2025-51356 · Deepchat · Deepchat

Published 2025-12-16 · Updated 2026-01-02 · CVE-2025-67744

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DeepChat versions prior to 0.5.3

Description DeepChat is an open-source artificial intelligence agent platform. A security issue exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. This Cross-Site Scripting (XSS) flaw escalates to full Remote Code Execution (RCE), enabling an attacker to execute arbitrary system commands. The issue is caused by the exposure of the Electron IPC renderer to the DOM, combined with unsafe Mermaid configuration and an exposed IPC interface.

Recommendations Update DeepChat to version 0.5.3 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-67744

GHSA-W8W8-82PV-5RG9

Affected Products

Deepchat

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67744.json · Exploit
• https://github.com/ThinkInAIXYZ/deepchat/commit/b179d97921af04a0ae1ae68757338dd8b8cbefe7 · Patch
• https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-w8w8-82pv-5rg9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67744 · Security Note
• https://twitter.com/CveFindCom/status/2000742499472593341 · Twitter Post
• https://t.me/CVEtracker/39902 · Telegram Post
• https://twitter.com/CVEnew/status/2002836002428108922 · Twitter Post
• https://t.me/cveNotify/147578 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000837937131393091 · Twitter Post
• https://twitter.com/0dayPublishing/status/2000735238645797006 · Twitter Post
• https://twitter.com/offseq/status/2000763856755548561 · Twitter Post