CVE-2026-108852
Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass
- State
- Published
- Severity
- 2.1 Low
- Published
- Oct 11, 2026
- Updated
- Oct 13, 2026
- Reserved
- Oct 11, 2026
Description
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.1 Low | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Deep ChatOvidijusParsiunas |
|
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ovidijusparsiunas-deep-chat-markdown-scheme-validationthird-party-advisory
- https://github.com/OvidijusParsiunas/deep-chat/blob/2.5.1/component/src/views/chat/messages/remarkable/remarkableConfig.ts#L74-L78technical-description
- https://github.com/OvidijusParsiunas/deep-chatproduct
- VulnCheck Advisory: Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.