CVE-2026-108852 in Deep Chat
Summary
by MITRE • 10/11/2026
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The security flaw identified within Deep Chat versions up to 2.5.1 represents a significant cross-site scripting vulnerability rooted in improper input validation and output encoding mechanisms. Specifically, the issue arises from the behavior of the RemarkableConfig.createNew function, which is designed to configure the Markdown rendering engine used by the application. In this specific configuration state, the system disables standard link validation protocols that are typically employed to sanitize user-supplied data before it is rendered in the browser environment. This oversight creates a direct pathway for attackers to inject malicious payloads into the application's output stream without triggering automatic security filters or sanitization routines.
The technical mechanism of exploitation relies on the ability to manipulate how Markdown links are processed and subsequently rendered as HTML anchor tags. By crafting specific Markdown syntax that includes javascript: URIs, an attacker can bypass standard href attribute restrictions. When a victim interacts with content generated by the application—whether it appears in AI-generated responses, is injected via addMessage API calls, or is loaded from previously saved history—the browser interprets these crafted links as executable scripts rather than navigational elements. The vulnerability is triggered specifically upon user interaction, meaning that passive viewing of the page does not immediately result in code execution; however, a simple click on the malicious link initiates the payload within the context of the embedding domain.
The operational impact of this vulnerability is severe due to its potential for session hijacking and data exfiltration. Since the injected JavaScript executes with the same privileges as the legitimate application, an attacker can access sensitive cookies, local storage items, or other authentication tokens stored by Deep Chat. This capability allows for unauthorized access to user accounts if the victim is authenticated at the time of exploitation. Furthermore, attackers could potentially perform actions on behalf of the victim, such as modifying settings, sending messages, or accessing connected services that rely on the same session context. The vulnerability affects multiple input vectors including dynamic AI responses and historical data loads, increasing the attack surface significantly for any deployment using these versions.
From a classification perspective, this issue aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting XSS. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter specifically under the JavaScript sub-category, where attackers use scripts to execute commands or perform actions within a victim's browser session. The root cause is categorized under CWE-20 Improper Input Validation as the application fails to adequately validate or sanitize input data before processing it through the Markdown renderer.
To mitigate this vulnerability, immediate updates to Deep Chat version 2.5.1 and later are strongly recommended by the vendor. These newer releases address the underlying issue within the RemarkableConfig configuration logic. In environments where an upgrade is not immediately feasible, administrators should implement strict Content Security Policy headers that restrict script execution from untrusted sources and disable javascript: URIs in href attributes via browser-level configurations or proxy rules. Additionally, input validation layers should be reinforced to ensure that any Markdown content processed by the application undergoes rigorous sanitization before being rendered, ensuring that only safe protocols such as http https mailto and tel are permitted for link destinations.