CVE-2026-108852: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in OvidijusParsiunas Deep Chat
Description
Deep Chat versions from 1.4.7 through 2.5.1 contain a low-severity cross-site scripting (XSS) vulnerability. This occurs because the RemarkableConfig.createNew function disables link validation, allowing attackers to inject crafted javascript: links. These malicious links can be embedded in AI responses, added messages, or loaded chat history, leading to script execution when a victim clicks the link.
CVSS v4.0
Score 2.1low
Affected software
OvidijusParsiunas
Deep Chat
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108852 is a cross-site scripting vulnerability in OvidijusParsiunas Deep Chat through version 2.5.1. The vulnerability arises from the RemarkableConfig.createNew function disabling link validation in Markdown links, which allows attackers to inject javascript: links. These crafted links can be placed in AI-generated responses, user-added messages, or chat history, resulting in script execution in the context of the embedding page upon user interaction.
Potential Impact
An attacker can execute arbitrary JavaScript in the context of the victim's browser when the victim clicks a maliciously crafted Markdown link. This can lead to potential client-side script execution risks such as session hijacking or other user-targeted attacks. However, exploitation requires user interaction (clicking the link), and the overall severity is rated low.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when clicking links in AI responses, added messages, or chat history within affected versions of Deep Chat.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-11T12:57:38.031Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acb93d12cdf04f656d70763
Added to database: 10/11/2026, 13:49:05 UTC
Last enriched: 10/11/2026, 14:04:01 UTC
Last updated: 10/11/2026, 21:33:10 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.