CVE-2025-55733 - CVE House

Back to Database

Status published Critical CVE-2025-55733

DeepChat One-click Remote Code Execution through Custom URL Handling

9.7 CVSS

Vulnerability Description

DeepChat is a smart assistant that connects powerful AI to your personal world. DeepChat before 0.3.1 has a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted deepchat: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (deepchat:), causing the DeepChat application to launch and process the URL, leading to remote code execution on the victim’s machine. This vulnerability is fixed in 0.3.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55733

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from ThinkInAIXYZ

View All →

Mermaid XSS vulnerability leads to Remote Code Execution

DeepChat's Incomplete XSS Fix Allows RCE through Mermaid Content

DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)

DeepChat's Mermaid rendering has XSS leading to RCE

Affected Vendor

ThinkInAIXYZ

View all reports →

Affected Software

deepchat

Vulnerable Versions:

< 0.3.1

Timeline

Official Publish: August 19th, 2025

Last Modified: August 19th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation