CVE-2025-67744: 
Homebrew vulnerability analysis and mitigation

CVE-2025-67744 is a critical Remote Code Execution (RCE) vulnerability in DeepChat, an open-source AI agent platform, arising from an XSS flaw in its Mermaid diagram rendering component that escalates to full RCE via an exposed Electron IPC interface. It affects all DeepChat versions up to and including v0.5.2, with the fix introduced in v0.5.3. The vulnerability was published on December 16, 2025, and assigned a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory, Red Hat CVE).

The vulnerability (CWE-94: Improper Control of Code Generation) stems from two concurrent weaknesses in DeepChat's MarkdownRenderer.vue component: it renders Mermaid diagrams via MermaidBlockNode from the markstream-vue library without any sanitization or security configuration, permitting javascript: URIs in click event handlers. Simultaneously, the window.electron.ipcRenderer object is exposed to the DOM's global scope in the Electron renderer process, allowing injected JavaScript to invoke privileged main-process IPC handlers. An attacker who can deliver a malicious Mermaid diagram block to a victim (e.g., via an AI-generated response or shared content) can trigger arbitrary system command execution when the user interacts with the rendered diagram. The advisory includes a proof-of-concept payload that registers and launches a malicious MCP server (e.g., calc.exe) via IPC invocation (GitHub Advisory).

Successful exploitation grants an attacker full Remote Code Execution on the victim's host system with the privileges of the DeepChat process, resulting in high confidentiality, integrity, and availability impact. An attacker can execute arbitrary system commands, exfiltrate sensitive data, install malware, or use the compromised host as a pivot point for lateral movement within a network. The scope change in the CVSS score reflects that the vulnerability in the renderer process crosses into the Electron main process, effectively breaking the application sandbox (GitHub Advisory, Security Boulevard).

A proof-of-concept payload is publicly documented in the GitHub Security Advisory, demonstrating exploitation via a crafted Mermaid diagram block that invokes window.electron.ipcRenderer to execute system commands. Exploitation requires minimal user interaction (clicking a node in the rendered diagram) and no privileges. As of the available intelligence, there is no confirmed evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.00166, indicating a currently low probability of widespread exploitation (GitHub Advisory, Feedly). The vulnerability is not listed in the CISA KEV catalog.

1. Craft malicious Mermaid payload: Construct a Mermaid diagram block containing a click event handler with a javascript: URI that invokes window.electron.ipcRenderer to call privileged IPC handlers, for example:

```mermaid
graph TD
  A[Click A]
  click A "javascript:(async()=>{ const ipc=window.electron.ipcRenderer; await ipc.invoke(`presenter:call`, `mcpPresenter`, `addMcpServer`, `test`, {command:`calc.exe`,args:[],type:`stdio`,enabled:true,name:`test`}); await ipc.invoke(`presenter:call`, `mcpPresenter`, `startServer`, `test`);})()" 

2. **Deliver payload to victim**: Inject the malicious Mermaid block into a conversation context that DeepChat will render — this could be via a malicious AI model response, a shared chat export, or any user-controlled input that reaches `MarkdownRenderer.vue`.
3. **Trigger user interaction**: The victim views the rendered diagram in DeepChat; when they click the malicious node (e.g., node `A`), the `javascript:` URI executes in the renderer process.
4. **Escalate via IPC**: The injected JavaScript accesses `window.electron.ipcRenderer` (exposed globally) and invokes privileged main-process handlers (e.g., `mcpPresenter:addMcpServer`, `mcpPresenter:startServer`) to register and launch an arbitrary system command.
5. **Achieve RCE**: The main process executes the attacker-specified command (e.g., `calc.exe` or a reverse shell binary) with the privileges of the DeepChat application ([GitHub Advisory](https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-w8w8-82pv-5rg9)).

• Logs: DeepChat application logs showing unexpected ipcRenderer.invoke calls to presenter:call with mcpPresenter handlers (addMcpServer, startServer) from the renderer process; JavaScript console errors related to Mermaid rendering or DOMPurify absence.
• Process: Unexpected child processes spawned by the DeepChat Electron process (e.g., calc.exe, cmd.exe, bash, powershell, or network tools like curl/wget); new MCP server processes registered under DeepChat.
• File System: New or modified MCP server configuration files in the DeepChat data directory; unexpected executables or scripts dropped in user-accessible directories.
• Network: Outbound connections from the DeepChat process to unknown external IPs or C2 infrastructure, particularly shortly after a Mermaid diagram was rendered (GitHub Advisory).

Upgrade DeepChat to version 0.5.3 or later, which patches the vulnerability by applying DOMPurify sanitization to Mermaid diagram content before rendering and enforcing securityLevel: 'strict' in the Mermaid configuration (GitHub Commit, GitHub Advisory). As a temporary workaround if upgrading is not immediately possible, disable or restrict Mermaid diagram rendering within the application and implement strict input validation for diagram configurations. Additionally, restricting the exposure of window.electron.ipcRenderer to the DOM is a key architectural fix included in the patch.

The vulnerability received coverage from The Hacker Wire and Security Boulevard, both highlighting the XSS-to-RCE escalation chain via Electron IPC as a notable example of Electron application security risks (The Hacker Wire, Security Boulevard). The vulnerability was also noted in CISA's weekly vulnerability bulletin for the week of December 15, 2025 (CISA Bulletin). Community discussion on Mastodon (infosec.exchange) and Bluesky flagged the critical severity and the ease of exploitation given the publicly available PoC.