DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f) - ATR-2026-01968 (02f36a75-ae43-5341-90aa-de17f71c3756)
Detects CVE-2026-43899 / GHSA-cp8j-jx7q-7r5f (CRITICAL): incomplete fix of CVE-2025-55733 in ThinkInAIXYZ/deepchat (< 1.0.4-beta.1). The native Electron window handler in src/main/presenter/tabPresenter.ts calls shell.openExternal(url) inside setWindowOpenHandler() without the ALLOWED_PROTOCOLS check that exists in the renderer preload, so a Markdown link rendered with target="_blank" reaches the OS protocol handler unsanitised. A poisoned LLM API response (e.g. from a custom /v1/chat/completions endpoint) returns Markdown such as "click here" or "open" to launch arbitrary protocol handlers (calculator://, smb://, ms-msdt://, bash://, file://) for host-level code execution and NTLM credential theft over SMB.