Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108852Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass

Medium 4.7

In plain English

A medium-severity cross-site scripting in Deep Chat from OvidijusParsiunas. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.2%top 91.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.

Affected products (as reported)

Vendor	Product	Versions
OvidijusParsiunas	Deep Chat	1.4.7 – through 2.5.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ovidijusparsiunas-deep-chat-markdown-scheme-validation third-party-advisory
https://github.com/OvidijusParsiunas/deep-chat/blob/2.5.1/component/src/views/chat/messages/remarkable/remarkableConfig.ts#L74-L78 technical-description
https://github.com/OvidijusParsiunas/deep-chat product
VulnCheck Advisory: Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass third-party-advisory