DeepChat versions prior to 0.3.5 contain a critical code injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code within the application.

This vulnerability is a Code Injection (CWE-94) flaw occurring in the Mermaid chart rendering component. An unauthenticated attacker can supply malicious input that is improperly processed via innerHTML, leading to potential cross-site scripting or remote code execution depending on the execution context.

Successful exploitation of this vulnerability allows for full system compromise, as indicated by the CVSS score of 9.6. This poses a severe risk to data confidentiality, integrity, and availability, potentially resulting in unauthorized access to sensitive assistant data and full control over the affected application instance.

Immediate Action: Update the DeepChat installation to version 0.3.5 or later immediately.

Proactive Monitoring: Monitor application logs for unusual script execution patterns or unauthorized requests directed at the Mermaid rendering endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious payloads containing script tags or suspicious chart rendering syntax.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and the high CVSS score, organizations must prioritize patching to version 0.3.5. Failure to address this flaw leaves the application open to severe exploitation, and immediate administrative action is required to secure the environment.