Vulnerability in OvidijusParsiunas Deep Chat

[ Description ]Official description

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/OvidijusParsiunas/deep-chat
• github.com/OvidijusParsiunas/deep-chat/blob/2.5.1/component/src/views/chat/messages/rem…
• hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ovidijusparsiunas-deep-chat-markdown-scheme-validation
• www.vulncheck.com/advisories/deep-chat-through-2.5.1-xss-via-markdown-link-validation-b…