CVE-2025-66222 CRITICAL

CVE-2025-66222: DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)

Vendor Thinkinaixyz
Product deepchat
Weakness CWE-94 · Code injection
Published December 3, 2025
Last update December 3, 2025
View on NVD All CVEs

CVSS base score

9.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC bridge, this XSS can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP (Model Context Protocol) server.

Key dates

02Disclosure timeline

December 3, 2025 CVE published
December 3, 2025 Record updated