Stored Cross-Site Scripting Vulnerability in DeepChat AI Assistant
CVE-2025-66222

9.7CRITICAL

Key Information:

Vendor

Thinkinaixyz

Status
Deepchat
Vendor
CVE Published:
3 December 2025

What is CVE-2025-66222?

DeepChat, an artificial intelligence smart assistant, is vulnerable to a Stored Cross-Site Scripting (XSS) issue in its Mermaid diagram renderer. This flaw enables attackers to execute arbitrary JavaScript within the application's context. The vulnerability can be escalated due to the exposed Electron IPC bridge, allowing an attacker to initiate a malicious Model Context Protocol (MCP) server and achieve Remote Code Execution (RCE), putting users' data and systems at significant risk.

Affected Version(s)

deepchat < 0.5.0

References

https://github.com/ThinkInAIXYZ/deepchat/security/advisor...
x_refsource_CONFIRM
https://github.com/ThinkInAIXYZ/deepchat/commit/371ca7b42...
x_refsource_MISC

CVSS V3.1

Score:
9.7
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.