{"data":{"id":"cc390603-b49a-46fb-830a-d9f7488798fe","title":"CVE-2026-43899: DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to…","summary":"CVE-2026-43899 affects DeepChat, an open-source AI agent platform, prior to v1.0.4-beta.1. An incomplete fix for CVE-2025-55733 left native Electron pop-up window handlers unsanitized, so a malicious Markdown link with target=\"_blank\" can route a URL through tabPresenter.ts directly to shell.openExternal(url), bypassing the isValidExternalUrl check. A compromised AI endpoint or attacker can trigger this, enabling arbitrary protocol execution.","solution":"Fixed in v1.0.4-beta.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43899","publishedAt":"2026-05-11T23:20:21.410Z","cveId":"CVE-2026-43899","cweIds":["CWE-20"],"cvssScore":"9.6","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["DeepChat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"DeepChat arbitrary protocol execution through native pop-up window handlers","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00401,"epssCheckedAt":"2026-11-07T12:08:48.407Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T06:12:05.541Z","patchAvailable":null,"disclosureDate":"2026-05-11T23:20:21.410Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}