Advisories · Technology
ThinkInAIXYZ deepchat.
Every CVE that names ThinkInAIXYZ deepchat among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.6 CriticalCritical · CVSS 9+
DeepChat: Incomplete Fix for CVE-2025-55733 leads to Remote Code Execution via Markdown Links bypassing `isValidExternalUrl`
- ThinkInAIXYZ deepchat
- CWE-20
- CVSS 9.3 CriticalCritical · CVSS 9+
DeepChat: Persistent DOM XSS via HTML Entity Encoding in `<antArtifact>` SVG Rendering (Bypass of `svgSanitizer.ts`)
- ThinkInAIXYZ deepchat
- Cross-site scripting (XSS)
- CVSS 9.7 CriticalCritical · CVSS 9+
Mermaid XSS vulnerability leads to Remote Code Execution
- ThinkInAIXYZ deepchat
- Code injection
- CVSS 9.7 CriticalCritical · CVSS 9+
DeepChat's Incomplete XSS Fix Allows RCE through Mermaid Content
- ThinkInAIXYZ deepchat
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.7 CriticalCritical · CVSS 9+
DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)
- ThinkInAIXYZ deepchat
- Code injection
- CVSS 9.7 CriticalCritical · CVSS 9+
DeepChat's Mermaid rendering has XSS leading to RCE
- ThinkInAIXYZ deepchat
- Code injection
- CVSS 9.7 CriticalCritical · CVSS 9+
DeepChat One-click Remote Code Execution through Custom URL Handling
- ThinkInAIXYZ deepchat
- Code injection