Arbitrary Protocol Execution Bypass in DeepChat by ThinkInAIXYZ
CVE-2026-43899

9.6CRITICAL

Key Information:

Vendor

Thinkinaixyz

Status
Deepchat
Vendor
CVE Published:
11 May 2026

What is CVE-2026-43899?

DeepChat, an open-source AI platform developed by ThinkInAIXYZ, presents a vulnerability where improper mitigation related to an earlier vulnerability allows for arbitrary protocol execution bypass. This issue arises from a failure to sanitize certain Electron pop-up window handlers, even after previous security updates. Attackers can exploit this by sending a malicious Markdown link to a targeted endpoint, causing the application to open potentially harmful URLs without proper validation. The issue has been addressed in version 1.0.4-beta.1, eliminating this security risk.

Affected Version(s)

deepchat < 1.0.4-beta.1

References

https://github.com/ThinkInAIXYZ/deepchat/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.