CVE-2026-43900Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS) vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer (src/main/lib/svgSanitizer.ts) restricts script execution by scrubbing javascript: protocols using plain-text regular expressions. However, it fails to account for HTML entity decoding prior to Vue's v-html DOM insertion inside the SvgArtifact.vue component. By feeding an SVG artifact with obfuscated entities (e.g., javascript:alert(1)), an attacker can completely bypass the sanitizer, culminating in arbitrary JavaScript execution when a victim interacts with the rendered SVG Element. This vulnerability is fixed in v1.0.4-beta.1.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds149d
General
CVE-2026-43900 Cross-Site Scripting Vulnerability in DeepChat Prior to v... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-43900 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The text references a CVE‑identified cross‑site scripting flaw in DeepChat and provides a link for more details, but offers no additional context, exploits, or mitigations.
0000039
4.0K followersView on X
Kaitan ID Security@KaitanSecurity150d
Disclosure
🚨 CRITICAL — CVE-2026-43900 DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0… CVSS 9.3 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-43900 #Intel #CyberSecurity #InfoSec
Post summary
The tweet announces the discovery of a critical vulnerability (CVE-2026-43900) in DeepChat AI platform, noting a CVSS score of 9.3 and that no patch is yet available, with a link to a detailed analysis.
0000052
90 followersView on X

Explore more

Back to dashboard