CVE-2025-66222 is a critical (CVSS 9.6) stored cross-site scripting flaw in the Mermaid diagram renderer of DeepChat, an AI assistant desktop app. Through the exposed Electron bridge it escalates to remote code execution. Versions 0.5.0 and earlier are affected, and the advisory lists no patched version.
What's affected
- Product: DeepChat, a desktop AI assistant (npm package name DeepChat in the advisory).
- Affected: 0.5.0 and earlier.
- Fixed: the advisory lists patched versions as None. The record links a fix commit, so check the project releases for a build that includes it before assuming you are safe.
The record and the advisory agree on a critical rating. The record scores it 9.6.
How to check if you're exposed
Open the application, check the About or version screen, and compare it with 0.5.0.
On a managed fleet, list installed applications through your endpoint tool and search for DeepChat. For source or npm based installs:
npm ls DeepChat
Then check whether users have enabled features that load content from the web, or whether chats can include model output from sources you do not control, since that is how hostile content reaches the renderer.
What to do now
- Check the DeepChat releases page for a version that includes the fix commit linked in the sources, and update when one is available.
- If no fixed build is available to you, stop using the app for untrusted content, or remove it from managed machines.
- Tell users not to paste or load untrusted prompts, web search results or shared conversations into the app.
- Run AI desktop clients under a standard user account, not an administrator account.
- Inventory desktop apps built on Electron along with web dependencies. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The advisory describes a chain. First, the Mermaid renderer inserts diagram content into the page as HTML, which allows script to run, a case of CWE-79, CWE-94. Second, the app exposes its Electron IPC bridge to the page. Third, an MCP server management method accepts a command to run without validating it. Each step is ordinary on its own, and together they let content in a chat message run commands on the user's machine.
This pattern is growing as AI clients add tool support. Model output, web results and shared chats are all untrusted input, and a privileged bridge turns a display bug into code execution. The record does not mark this as exploited in the wild and it is not on CISA KEV.
Quick check
Can a malicious chat message really run commands?
The advisory describes that chain: script in the rendered diagram calls the exposed bridge to register and start an MCP server. That is why it is critical.
Is there a patched release?
The advisory lists none. A fix commit exists in the project, so verify a release that contains it.
Sources
Last reviewed: 18 October 2026.
