# DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)

- **Severity:** Critical
- **Signature ID:** `f23ee1be-0dec-4fd1-a27c-ab8bf37979d5`
- **CVEs:** CVE-2025-66481
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

DeepChat, an Electron-based chat app, renders Mermaid diagrams but only partially cleans dangerous content out of them. An attacker can hide a script inside a diagram using an unquoted HTML event handler that the app's filter misses, and use it to run arbitrary commands on the victim's machine.

## How the attack works

An attacker crafts a Mermaid diagram containing an HTML tag with an unquoted event handler, such as <audio src=x onerror=...>. DeepChat's sanitizer only matches quoted handler attributes (like onerror="..."), so the unquoted version passes through untouched and executes as JavaScript inside the Electron renderer. That injected script calls DeepChat's internal Electron IPC bridge (window.electron.ipcRenderer.invoke) to reach a privileged 'presenter' API, registering a new MCP server and starting it with an attacker-chosen command, for example launching calc.exe as a proof of concept. This turns a rendering bug in a chat UI into full code execution on the host, because the renderer has a bridge into powerful main-process functions.

## Why it matters

An attacker who can get a victim to view a malicious Mermaid diagram inside DeepChat can achieve remote code execution on that victim's machine, with no further user action needed beyond viewing the diagram.

## What you can do

- Update DeepChat past version 0.5.1 once a fix is available, or disable Mermaid diagram rendering until patched.
- Review and restrict what the Electron IPC 'presenter' bridge exposes to the renderer, especially mcpPresenter addMcpServer/startServer, so untrusted renderer content cannot call it.
- Treat any content rendered from chat messages or diagrams as untrusted; sanitize HTML attributes with a robust parser instead of a regex, and reject any unrecognized attribute rather than only stripping known-bad patterns.
- Monitor for unexpected MCP server registrations or new stdio server launches from DeepChat, particularly ones running unfamiliar commands.

## Known benign look-alikes

- A legitimate Mermaid diagram (graph/flowchart/sequenceDiagram) with node labels and no event-handler attributes or IPC calls.
- DeepChat source/docs discussing the electron.ipcRenderer presenter bridge or mcpPresenter API without an embedded onerror handler payload.
- A normal addMcpServer config object with command:'npx' that is not wrapped inside an HTML event handler attribute.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01967
- https://nvd.nist.gov/vuln/detail/CVE-2025-66481

---
Source: https://www.netzilo.com/threats/atr-deepchat-mermaid-xss-to-rce-via-electron-ipc-mcp-server-regi