A persistent DOM XSS flaw exists in DeepChat versions before v1.0.4‑beta.1. The backend sanitizes SVG content by removing script execution patterns from plain text, but it does not account for HTML entity decoding that occurs before Vue’s v‑html rendering. An attacker can embed a malicious payload as an encoded entity (for example, javascript:alert(1)) inside an SVG artifact. When the victim views the artifact, the entity is decoded, the SVG sanitizer is bypassed, and the embedded JavaScript runs with the victim’s browser permissions. The impact includes arbitrary client‑side code execution, which can lead to data theft, session hijacking, or phishing attacks on the user. The vulnerability is limited to the victim’s browser; it does not provide a remote code execution command on the server. Because the exploit requires the victim to view a crafted SVG, the attack surface is narrow but still high risk for users who share or view SVG artifacts. The flaw is persistent – once the malicious SVG is delivered or stored, the XSS will trigger on every subsequent View. Given the CVSS score of 9.3, this is a high‑severity vulnerability. The EPSS score is unavailable, so the exploitation probability is uncertain; however, there is no indication that it has been actively exploited in the wild. The vulnerability is not currently listed in the CISA KEV catalog.

ThinkInAIXYZ:deepchat, all releases before v1.0.4‑beta.1. The issue resides in the svgsanitizer.ts library and the SvgArtifact.vue component that renders SVG artifacts using v‑html.

The flaw can be exploited by a malicious actor who controls the content of an SVG artifact that a user will view. Because the attack relies on client‑side code execution, a privileged user can take over the victim’s session or steal data locally. The lack of an EPSS score and absence from KEV suggests no widespread exploitation yet, but the high CVSS indicates that once discovered, the vulnerability could be widely abused. An attacker needs only to craft the SVG and ensure it reaches the target; no additional privileges or vulnerabilities are required.