DeepChat, an open‑source AI agent platform, had an incomplete fix for a prior vulnerability that allowed an attacker to execute code on a user’s machine. The flaw lies in the handling of Markdown links rendered in the application. When a link contains a target="_blank" attribute, a native Electron pop‑up window is created, and the URL is forwarded directly to shell.openExternal(url). This bypasses the security boundary defined by isValidExternalUrl. An attacker or a malicious AI endpoint that returns such a link can therefore trigger arbitrary external command execution, yielding full remote code execution on the target. The weakness is an instance of CWE‑20: Improper Input Validation.

ThinkInAIXYZ’s DeepChat product is affected, specifically versions prior to v1.0.4‑beta.1. No specific sub‑versions are listed beyond the general pre‑1.0.4‑beta.1 range, so any deployment of DeepChat older than that release is vulnerable.

The CVSS score of 9.6 indicates critical severity, and the EPSS score is not available, so the current public exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via malicious markdown links that an attacker can inject into an AI endpoint or via a compromised AI service. Successful exploitation requires that the end user render the link inside the DeepChat UI, and the application’s shell.openExternal call will execute the injected URL, giving the attacker full control.