CVE-2026-108852 | BDVDB-2026-385804 Detail
OvidijusParsiunasDeep Chat
Description#
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References#
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ovidijusparsiunas-deep-chat-markdown-scheme-validation
- https://github.com/OvidijusParsiunas/deep-chat/blob/2.5.1/component/src/views/chat/messages/remarkable/remarkableConfig.ts#L74-L78
- https://github.com/OvidijusParsiunas/deep-chat
- https://www.vulncheck.com/advisories/deep-chat-through-2.5.1-xss-via-markdown-link-validation-bypass
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.