CVE-2025-67744 is a critical (CVSS 9.6) flaw in DeepChat, an open source AI agent platform for desktop. Unsafe Mermaid rendering allows script, and an exposed Electron IPC interface turns it into command execution. Upgrade to DeepChat 0.5.3, which contains the patch.
What's affected
DeepChat versions before 0.5.3. The GitHub advisory lists v0.5.2 and earlier as affected. The record says version 0.5.3 contains a patch. Both give 9.6, critical.
DeepChat is a desktop application, so each installation needs the update. The advisory notes two components render Mermaid. One was already fixed with a change from innerHTML to textContent, while the other, the main markdown renderer, passed content to the diagram component without security settings.
How to check if you're exposed
Open the application's About page and read the version. If it is below 0.5.3, update it.
For teams that build from source, confirm the tag, then check how diagrams are rendered:
git describe --tags
grep -rn "mermaid" src --include=*.vue --include=*.ts
If you develop another Electron app, look for the second root cause too: whether the renderer's global scope exposes the IPC object to page script.
grep -rn "contextIsolation\|nodeIntegration" src
What to do now
- Update every DeepChat install to 0.5.3 or later.
- Do not click interactive diagram nodes in conversations from untrusted sources until you have updated.
- Review the configured MCP servers and agent tools and remove any you did not add.
- If you build Electron apps, enable context isolation and expose only narrow, validated bridge functions.
- Set diagram libraries to their strict security level and sanitize rendered output.
Why it matters
The advisory names two concurrent issues. First, the Mermaid configuration allowed javascript: URIs in click handlers. Second, the Electron IPC renderer object was reachable from page scripts, so any injected script could call privileged main process handlers. Together they turn cross site scripting into remote command execution.
The class is CWE-94, code injection. The pattern is repeated in the same period in another desktop AI client, CVE-2025-66580. The shared lesson is that model output is untrusted input, and that desktop clients should never let rendered content reach privileged APIs. The record does not list this CVE as known exploited.
For defenders, the practical steps are short. Update the client, review the tool and server list it can start, and treat any conversation that includes interactive diagrams from an outside source as untrusted content. If your organization has approved AI desktop clients, add the minimum safe version to that approval so that older copies are flagged during inventory checks. Teams that build their own Electron tools should also add a test that fails if page scripts can reach the IPC bridge.
Quick check
Is the fix in 0.5.3?
Yes, the record says version 0.5.3 contains a patch.
Why is XSS so serious in an Electron app?
Electron pages can sometimes reach native capabilities. If a privileged bridge is exposed, script injection can become command execution.
Sources
Last reviewed: 18 October 2026.
