{"id":"CVE-2026-108852","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-108852","generatedAt":"2026-10-28T02:24:16.515Z","title":"Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation.","description":"Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.","published":"2026-10-11T14:17:05.000Z","lastModified":"2026-10-16T19:18:45.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":2.1,"severity":"LOW","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-79"],"affected":[],"epss":{"score":0.00185,"percentile":0.07973,"date":"2026-10-26","history":[{"date":"2026-10-12","score":0.00185,"percentile":0.0741}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-11T14:17:05.000Z","detail":{"score":"2.1","severity":"LOW","publishedAt":"2026-10-11T14:17:04.827Z"},"summary":"New CVE, low severity (CVSS 2.1)."}],"references":[{"url":"https://github.com/OvidijusParsiunas/deep-chat","source":"disclosure@vulncheck.com"},{"url":"https://github.com/OvidijusParsiunas/deep-chat/blob/2.5.1/component/src/views/chat/messages/remarkable/remarkableConfig.ts#L74-L78","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ovidijusparsiunas-deep-chat-markdown-scheme-validation","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/deep-chat-through-2.5.1-xss-via-markdown-link-validation-bypass","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-108852","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}