LOW 2.1 NVD
CVE-2026-108852
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disab
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.
References
- https://github.com/OvidijusParsiunas/deep-chat
- https://github.com/OvidijusParsiunas/deep-chat/blob/2.5.1/component/src/views/chat/message
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ovidijusparsiunas-deep-chat-markdown-scheme-vali
- https://www.vulncheck.com/advisories/deep-chat-through-2.5.1-xss-via-markdown-link-validat
This low severity vulnerability with a CVSS score of 2.1 was published on 2026-10-11 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.