DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)
DeepChat is an Electron-based chat app that renders Markdown from LLM API responses. A bug lets a link in that Markdown reach the operating system's protocol handler without the safety check the app is supposed to apply, so a malicious link can launch programs or leak credentials instead of just opening a web page.
How the attack works
An attacker controls or poisons the content returned by an LLM backend the app talks to, such as a custom /v1/chat/completions endpoint. That response contains a Markdown link with a target="_blank" attribute, using a scheme like calculator://, smb://, ms-msdt://, bash://, or file:// instead of http/https. DeepChat's window-open handler calls the OS-level shell.openExternal function to open the link but skips the allowed-protocol check that exists elsewhere in the app. The OS then hands the link to whatever handles that protocol, running a program, opening an SMB share, or triggering other protocol-specific behavior. This is a second, incomplete fix for an earlier version of the same flaw (CVE-2025-55733).
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9fb458ab-48e9-4b2e-bb71-ce9bc00f115e
- Severity
- Critical
Why it matters
An attacker who can influence what the AI model or API returns can achieve code execution on the user's machine or force it to connect to an attacker-controlled SMB share, which can leak Windows NTLM credentials, all without any file download or explicit user consent beyond clicking a chat link.
What you can do
- →Upgrade DeepChat to 1.0.4-beta.1 or later where this is fixed.
- →Do not point DeepChat at untrusted or unverified LLM API endpoints.
- →Block outbound SMB (445) and other unneeded protocol handlers at the network or host level for machines running this app.
- →Review any recent chat sessions or API responses for Markdown links using non-http(s) schemes such as smb://, ms-msdt://, bash://, or calculator://.
Known benign look-alikes
- Benign Markdown link to an https:// or http:// web page, e.g. [docs](https://example.com).
- Legitimate [open file](file:///Users/me/report.pdf) link to a local document with no UNC/SMB host.
- Mitigation advisory text recommending upgrade to deepchat 1.0.4-beta.1 without a deeplink payload.
- Electron docs describing setWindowOpenHandler returning { action: 'deny' } with a proper protocol allowlist.