CVE-2025-66222: Thinkinai Deepchat XSS Vulnerability

CVE-2025-66222 Overview

DeepChat is a smart assistant application that leverages artificial intelligence capabilities. A critical Stored Cross-Site Scripting (XSS) vulnerability exists in the Mermaid diagram renderer in versions 0.5.0 and earlier. This vulnerability allows an attacker to execute arbitrary JavaScript within the application context. Due to the exposed Electron IPC bridge, this XSS vulnerability can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP (Model Context Protocol) server.

Critical Impact

This vulnerability chain enables attackers to progress from Stored XSS to full Remote Code Execution through the Electron IPC bridge, potentially compromising the entire system running DeepChat.

Affected Products

• Thinkinai DeepChat version 0.5.0 and earlier
• All installations using the Mermaid diagram renderer feature
• Electron-based DeepChat deployments with exposed IPC bridge

Discovery Timeline

• 2025-12-03 - CVE-2025-66222 published to NVD
• 2025-12-05 - Last updated in NVD database

Technical Details for CVE-2025-66222

Vulnerability Analysis

This vulnerability represents a dangerous attack chain combining two distinct weakness types: Stored Cross-Site Scripting (CWE-79) and Code Injection (CWE-94). The Mermaid diagram renderer in DeepChat fails to properly sanitize user-supplied input before rendering diagram content, allowing malicious JavaScript to be persistently stored and executed within the application context.

What makes this vulnerability particularly severe is the Electron architecture of DeepChat. Unlike traditional web applications where XSS is limited to browser context, Electron applications expose Inter-Process Communication (IPC) bridges that can interact with the underlying operating system. An attacker can leverage this exposed IPC bridge to register and start a malicious Model Context Protocol (MCP) server, effectively escalating from client-side script execution to full Remote Code Execution on the host system.

The attack requires user interaction, as the victim must view the maliciously crafted Mermaid diagram content. However, once triggered, the attacker gains significant control over the victim's system with high impact to confidentiality, integrity, and availability.

Root Cause

The root cause stems from insufficient input validation and output encoding in the Mermaid diagram rendering component. The application fails to properly sanitize diagram definition strings before processing them, allowing embedded JavaScript payloads to execute. Combined with an insecurely configured Electron IPC bridge that exposes sensitive system-level functionality to the renderer process, the vulnerability creates a direct path from user-controlled content to arbitrary code execution.

Attack Vector

The attack leverages a network-based vector where an attacker crafts a malicious Mermaid diagram payload containing JavaScript code. When this payload is stored in the application (such as through a shared chat or document) and subsequently rendered by a victim user, the embedded JavaScript executes in the Electron renderer context. The attacker's script then leverages the exposed IPC bridge to communicate with the main Electron process, registering a malicious MCP server that executes arbitrary commands on the underlying operating system.

The attack does require user interaction—the victim must open or view content containing the malicious diagram—but no privileges are required for the attacker to inject the payload. The scope change in the attack indicates that the compromised Electron renderer can affect resources beyond its security scope by reaching the host system through the IPC bridge.

Detection Methods for CVE-2025-66222

Indicators of Compromise

• Unexpected MCP server registrations or processes spawned by DeepChat
• Mermaid diagram content containing suspicious JavaScript code patterns such as <script> tags, event handlers, or javascript: URIs
• Unusual IPC bridge activity or communications originating from the DeepChat renderer process
• Anomalous network connections or child processes spawned by the DeepChat application

Detection Strategies

• Monitor DeepChat logs and application data for Mermaid diagrams containing potentially malicious payloads
• Implement endpoint detection rules to identify unusual process creation chains originating from DeepChat
• Deploy application-level content security policies to detect XSS payload execution attempts
• Monitor for unauthorized MCP server registration events within the application

Monitoring Recommendations

• Enable verbose logging for DeepChat application activity and IPC communications
• Configure EDR solutions to alert on suspicious child process spawning from Electron applications
• Establish baseline network behavior for DeepChat and alert on deviations indicating potential C2 communications
• Review stored content periodically for signs of injected malicious payloads

How to Mitigate CVE-2025-66222

Immediate Actions Required

• Upgrade DeepChat to a version newer than 0.5.0 that includes the security fix
• Audit existing stored content for potentially malicious Mermaid diagram payloads
• Restrict network access for DeepChat installations if upgrade is not immediately possible
• Consider temporarily disabling Mermaid diagram rendering functionality until patched

Patch Information

ThinkInAI has addressed this vulnerability in commit 371ca7b42e3685aee6e3f0c61e85277ed1ff4db7. Organizations running affected versions should update to the patched version immediately. The fix addresses both the XSS vulnerability in the Mermaid renderer and secures the Electron IPC bridge to prevent escalation to RCE.

For detailed patch information, refer to the GitHub Commit Update and the GitHub Security Advisory GHSA-v8v5-c872-mf8r.

Workarounds

• Disable Mermaid diagram rendering functionality if the feature is not critical to operations
• Implement network-level controls to restrict DeepChat's ability to spawn external connections
• Run DeepChat in a sandboxed environment to limit the impact of potential RCE exploitation
• Apply Content Security Policy headers if deploying in a web context to mitigate XSS execution

# Example: Restrict DeepChat network access on Linux using iptables
# Block outbound connections from DeepChat process (adjust path as needed)
iptables -A OUTPUT -m owner --cmd-owner deepchat -j DROP

# Alternative: Run DeepChat with restricted permissions using firejail
firejail --net=none /path/to/deepchat