DeepChat One-click Remote Code Execution through Custom URL Handling

The impact of CVE-2025-55733 is severe. An attacker can leverage this vulnerability to gain complete control over a victim's system. The attack vector is deceptively simple: embedding a malicious 'deepchat:' URL on any website. When a user clicks this link, the DeepChat application, acting as a custom URL handler, processes the URL and executes the embedded code. This bypasses typical security measures, as the user is essentially tricked into running code they didn't intend to. The blast radius extends to any user of DeepChat running a vulnerable version, regardless of their technical expertise. This is similar to other URL scheme vulnerabilities where malicious code is injected through seemingly innocuous links.

Users of DeepChat, particularly those who frequently click on links from untrusted sources or visit websites with questionable content, are at significant risk. Individuals using DeepChat on corporate devices or systems containing sensitive data are especially vulnerable, as a successful exploit could lead to data breaches or system compromise.

1. 2025-08-19Disclosure

   disclosure

1. आरक्षित2025-08-14
2. प्रकाशित2025-08-19
3. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-55733 is to immediately upgrade DeepChat to version 0.3.1 or later. This version contains the fix that prevents the malicious URL processing. If upgrading is not immediately feasible, consider restricting the use of DeepChat on systems containing sensitive data. While a direct workaround is unavailable, educating users about the risks of clicking on unfamiliar or suspicious links can help prevent exploitation. There are no specific WAF or proxy rules that can effectively mitigate this vulnerability without application-level changes. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known malicious 'deepchat:' URL – it should no longer execute code.