CVE-2025-67744: XSS/RCE in DeepChat

The impact of CVE-2025-67744 is severe. An attacker can exploit this vulnerability to execute arbitrary code on the affected system. This is achieved by crafting malicious Mermaid diagrams that, when rendered, inject and execute JavaScript code. The exposed Electron IPC renderer allows this injected code to interact with the underlying system, effectively granting the attacker remote control. This could lead to data theft, system compromise, and potential lateral movement within the network. The combination of XSS and IPC exposure creates a highly dangerous attack vector, similar in impact to vulnerabilities that bypass security sandboxes.

1. Reserved2025-12-11
2. Published2025-12-16
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67744 is to immediately upgrade DeepChat to version 0.5.3 or later, which contains the necessary patch. If upgrading is not immediately feasible, consider implementing temporary workarounds. While a direct WAF rule is unlikely to be effective against this type of XSS, carefully scrutinizing input to the Mermaid renderer for suspicious characters or patterns could offer limited protection. Review and restrict access to the Electron IPC interface to prevent unauthorized interactions. After upgrading, confirm the fix by attempting to render a known malicious Mermaid diagram and verifying that no code execution occurs.