CVE-2026-108852 — Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable li…
Published: 2026-10-11 · CVSS: 2.1 · CVSS 4.0
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7