CVE-2025-67744

Katalog CVE

CVSS 9.6 · Critical EPSS 0,63%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada thinkinai deepchat. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. Due to the exposure of the Electron IPC renderer to the DOM, this Cross-Site Scripting (XSS) flaw escalates to full Remote Code Execution (RCE), allowing an attacker to execute arbitrary system commands. Two concurrent issues, unsafe Mermaid configuration and an exposed IPC interface, cause this issue. Version 0.5.3 contains a patch.

Rincian

Terbit di NVD

16 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-w8w8-82pv-5rg9 exploit · advisory vendor
• https://github.com/ThinkInAIXYZ/deepchat/commit/b179d97921af04a0ae1ae68757338dd8b8cbefe7 patch