CVE-2026-108852

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108852

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108852.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108852

Published

2026-10-11T13:26:02Z

Modified

2026-10-13T02:45:46Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass

Details

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108852.json"
}

References

Affected packages

Git / github.com/ovidijusparsiunas/deep-chat

Affected ranges

Type

GIT

Repo

https://github.com/ovidijusparsiunas/deep-chat

Events

Introduced

43f75d4b83f4397973c53c38b4a44f55b934bc49

Fixed

b537bcc6219bbe937ee8159166444912e56973f0

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.4.7"
        },
        {
            "last_affected":  "2.5.1"
        },
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.5.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

1.*

1.4.10

1.4.11

1.4.7

2.*

2.0.0

2.0.1

2.1.0

2.1.1

2.2.0

2.2.1

2.2.2

2.3.0

2.4.0

2.4.1

2.4.2

2.4.3

2.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108852.json"