What is CVE-2025-66222?

CVE-2025-66222 is a critical-severity vulnerability in Thinkinai Deepchat, classified under Code Injection. CVSS score: 9.6/10. Published 2025-12-03.

How severe is CVE-2025-66222?

Critical severity. CVSS v3 base score is 9.6 out of 10.

RCE in Thinkinai Deepchat

CVE-2025-66222

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC bridge, this XSS can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP (Model Context Protocol) server.

Vulnerability class: RCE (Remote Code Execution)

Published 2025-12-03 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.006 (47.0th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 47.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000

Affected products

Thinkinai Deepchat
Thinkinaixyz Deepchat — versions < 0.5.0

Weakness classification (CWE)

References

github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-v8v5-c872-mf8r (Exploit, Vendor Advisory)
github.com/ThinkInAIXYZ/deepchat/commit/371ca7b42e3685aee6e3f0c61e85277ed1ff4db7 (Patch)

Frequently asked questions

What is CVE-2025-66222?: CVE-2025-66222 is a critical-severity vulnerability in Thinkinai Deepchat, classified under Code Injection. CVSS score: 9.6/10. Published 2025-12-03.
How severe is CVE-2025-66222?: Critical severity. CVSS v3 base score is 9.6 out of 10.