CVE-2026-86185

Bilibili Desktop through 1.18.0 contains two compounding weaknesses: TLS certificate verification is disabled process-wide, and unsigned remote JavaScript configuration is executed without integrity checks. An on-path attacker can intercept configuration fetches, inject arbitrary JavaScript that ...

EUVD-2026-71994

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...

Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)

Summary A stored Cross-Site Scripting XSS vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution RCE. Details The vulnerability exists in the Renderer component responsible...

CVE-2025-66222

DeepChat (0.5.0 and earlier) is affected by a Stored XSS in the Mermaid diagram renderer, exploitable via the Electron IPC bridge to escalate to RCE by starting a malicious MCP server. Affected product/version: DeepChat prior to 0.5.0. Root cause: XSS within Mermaid rendering allows arbitrary Jav...

PT-2025-48981

Name of the Vulnerable Software and Affected Versions DeepChat versions prior to 0.5.0 Description DeepChat, an AI smart assistant, contains a Stored Cross-Site Scripting XSS issue within the Mermaid diagram renderer. This allows an attacker to execute arbitrary JavaScript code within the...