CVE-2026-43900
Cross-Site Scripting in DeepChat AI Platform
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| deepchat | deepchat | to 1.0.4-beta.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) issue in DeepChat, an open-source AI agent platform. It arises because the backend validation layer and the frontend browser rendering engine handle SVG content differently. Specifically, the SVGSanitizer attempts to block script execution by removing javascript: protocols using simple regular expressions, but it does not consider HTML entity decoding that happens before Vue's v-html DOM insertion. An attacker can exploit this by embedding obfuscated entities in an SVG artifact, such as javascript:alert(1), which bypasses the sanitizer and allows arbitrary JavaScript to execute when a user interacts with the rendered SVG element.
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary JavaScript execution in the context of the victim's browser when they interact with a malicious SVG element. This can result in unauthorized actions such as stealing sensitive information, session hijacking, defacement, or performing actions on behalf of the user without their consent. Because the CVSS base score is 9.3 with high confidentiality and integrity impacts, the vulnerability poses a severe risk to affected systems.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in DeepChat version v1.0.4-beta.1. The immediate step to mitigate this vulnerability is to upgrade your DeepChat installation to version v1.0.4-beta.1 or later.