PT-2026-39860 · Deepchat · Deepchat

Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-43900

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions DeepChat versions prior to 1.0.4-beta.1

Description A Cross-Site Scripting (XSS) issue exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer function (src/main/lib/svgSanitizer.ts) attempts to prevent script execution by scrubbing javascript: protocols using plain-text regular expressions. However, it does not account for HTML entity decoding before the v-html DOM insertion occurs within the SvgArtifact.vue component. An attacker can bypass the sanitizer by using obfuscated entities, such as javascript:alert(1), leading to arbitrary JavaScript execution when a victim interacts with the rendered SVG Element.

Recommendations Update to version 1.0.4-beta.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-43900

Affected Products

Deepchat

References · 6

• 🔥 https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-7r59-67v3-3mgp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43900 · Security Note
• https://t.me/CVEtracker/53431 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2053988545136591127 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054166491994431962 · Twitter Post
• https://t.me/cveNotify/163146 · Telegram Post