CVE-2025-67744 — CRITICAL (9.6)

Q: How severe is CVE-2025-67744?

CVE-2025-67744 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2025-67744?

Check the references section above for vendor advisories and patch information. Affected products include: Thinkinai Deepchat.

Vulnerability Description

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. Due to the exposure of the Electron IPC renderer to the DOM, this Cross-Site Scripting (XSS) flaw escalates to full Remote Code Execution (RCE), allowing an attacker to execute arbitrary system commands. Two concurrent issues, unsafe Mermaid configuration and an exposed IPC interface, cause this issue. Version 0.5.3 contains a patch.

CVSS Score

9.6

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Thinkinai	Deepchat	< 0.5.3

Related Weaknesses (CWE)

CWE-94

References

FAQ

What is CVE-2025-67744?

CVE-2025-67744 is a vulnerability with a CVSS score of 9.6 (CRITICAL). DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering compo...

How severe is CVE-2025-67744?

CVE-2025-67744 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-67744?

Check the references section above for vendor advisories and patch information. Affected products include: Thinkinai Deepchat.