DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)
DeepChat, an Electron-based chat app, renders Mermaid diagrams but only partially cleans dangerous content out of them. An attacker can hide a script inside a diagram using an unquoted HTML event handler that the app's filter misses, and use it to run arbitrary commands on the victim's machine.
How the attack works
An attacker crafts a Mermaid diagram containing an HTML tag with an unquoted event handler, such as <audio src=x onerror=...>. DeepChat's sanitizer only matches quoted handler attributes (like onerror="..."), so the unquoted version passes through untouched and executes as JavaScript inside the Electron renderer. That injected script calls DeepChat's internal Electron IPC bridge (window.electron.ipcRenderer.invoke) to reach a privileged 'presenter' API, registering a new MCP server and starting it with an attacker-chosen command, for example launching calc.exe as a proof of concept. This turns a rendering bug in a chat UI into full code execution on the host, because the renderer has a bridge into powerful main-process functions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f23ee1be-0dec-4fd1-a27c-ab8bf37979d5
- Severity
- Critical
- CVEs
- CVE-2025-66481
Why it matters
An attacker who can get a victim to view a malicious Mermaid diagram inside DeepChat can achieve remote code execution on that victim's machine, with no further user action needed beyond viewing the diagram.
What you can do
- →Update DeepChat past version 0.5.1 once a fix is available, or disable Mermaid diagram rendering until patched.
- →Review and restrict what the Electron IPC 'presenter' bridge exposes to the renderer, especially mcpPresenter addMcpServer/startServer, so untrusted renderer content cannot call it.
- →Treat any content rendered from chat messages or diagrams as untrusted; sanitize HTML attributes with a robust parser instead of a regex, and reject any unrecognized attribute rather than only stripping known-bad patterns.
- →Monitor for unexpected MCP server registrations or new stdio server launches from DeepChat, particularly ones running unfamiliar commands.
Known benign look-alikes
- A legitimate Mermaid diagram (graph/flowchart/sequenceDiagram) with node labels and no event-handler attributes or IPC calls.
- DeepChat source/docs discussing the electron.ipcRenderer presenter bridge or mcpPresenter API without an embedded onerror handler payload.
- A normal addMcpServer config object with command:'npx' that is not wrapped inside an HTML event handler attribute.