Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass (RCE). While the patch correctly restricted api.openExternal() inside the renderer's preload/index.ts script, it structurally neglected to sanitize native Electron pop-up window handlers. An attacker or a compromised AI endpoint returning a Markdown link can trigger a target="_blank" native window interception in tabPresenter.ts, which forwards the malicious URL directly to shell.openExternal(url) and completely bypasses the isValidExternalUrl security boundary. This vulnerability is fixed in v1.0.4-beta.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-43899 Remote Code Execution via Arbitrary Protocol Execution Bypass in DeepChat Before v1.0.4-beta.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-43899
Post summary
A newly disclosed RCE vulnerability (CVE-2026-43899) allows an attacker to bypass protocol execution checks in DeepChat versions prior to v1.0.4-beta.1.
🚨 CRITICAL — CVE-2026-43899 DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0… CVSS 9.6 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-43899 #Intel #CyberSecurity #InfoSec
Post summary
The post announces CVE-2026-43899 as a critical vulnerability (CVSS 9.6) in DeepChat, notes that no patch is available yet, and links to a full analysis.