Threat database

Deep Chat versions from 1.4.7 through 2.5.1 contain a cross-site scripting (XSS) vulnerability. This flaw arises because the RemarkableConfig.createNew function disables link validation, allowing attackers to inject javascript: links via crafted Markdown links. These malicious links can appear in AI responses, addMessage content, or loaded history, leading to script execution when a victim clicks them. The vulnerability has a low CVSS score of 2.1 and requires user interaction to exploit.