Vulnerability details

CVE-2025-55733

ThinkInAIXYZ deepchat

DeepChat One-click Remote Code Execution through Custom URL Handling

CVSS 3.1

9.7Critical

Official description

DeepChat is a smart assistant that connects powerful AI to your personal world. DeepChat before 0.3.1 has a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted deepchat: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (deepchat:), causing the DeepChat application to launch and process the URL, leading to remote code execution on the victim’s machine. This vulnerability is fixed in 0.3.1.

CVSS scores

Score	Version	Source	Vector
9.7Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
ThinkInAIXYZ	deepchat	< 0.3.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/ThinkInAIXYZ/deepchat/commit/a0ff6f362e01ddceb7fd42d0af0b28b6184fb4d2 x_refsource_MISC
https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-hqr4-4gfc-5p2j x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-08-19
Last updated: 2025-08-20
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.68%

Probability of exploitation in 30 days

52.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-94
Improper Control of Generation of Code ('Code Injection')