CVE-2025-55733

The vulnerability stems from improper handling of a custom URL protocol handler (deepchat:) registered by the DeepChat application in the operating system. An attacker embeds a specially crafted URL with the deepchat: scheme on a website controlled by them. When the victim visits the site or clicks on the link, the browser passes control to the system handler, which launches the DeepChat application and passes the malicious payload to it. The application processes the URL content without proper validation, leading to code execution on the victim's machine (CWE-94 — improper control of generation of code).

Successful exploitation of the vulnerability allows an attacker to execute arbitrary code remotely (RCE) on the victim's machine in the context of the privileges of the running DeepChat process. With high impact ratings on confidentiality, integrity, and availability (all H), it is possible to gain full control over the victim's system.

The DeepChat application should be updated immediately to version 0.3.1 or later, in which the vulnerability has been fixed. The vulnerability is removed in commit a0ff6f362e01ddceb7fd42d0af0b28b6184fb4d2. Until an update is applied, consider unregistering the custom deepchat: protocol handler from the operating system or restricting the application's ability to be launched by a browser.

DeepChat application (Thinkinai/ThinkInAIXYZ) in all versions prior to 0.3.1.