What happened
Deep Chat disables Remarkable's link validation in RemarkableConfig.createNew, allowing javascript: and other dangerous scheme links to be rendered into clickable elements. Since AI responses and imported history are attacker-influenceable content, a poisoned link executes script in the host application's origin when clicked.
Why it matters
Chat widget libraries render model output as trusted UI. A javascript: link smuggled through an AI response turns a single click into same-origin script execution on any page embedding Deep Chat — enabling cookie theft or session hijacking in the host AI application.
Attack vector
RemarkableConfig.createNew disables Remarkable link validation, so crafted Markdown links such as javascript: survive rendering. An attacker controls links inside AI responses, addMessage content, or loaded history; a victim clicking the rendered link executes script in the embedding page's origin.
Affected systems
deep-chat (npm) 1.4.7 through 2.5.1 (RemarkableConfig.createNew link validation)
Mitigation
Upgrade deep-chat beyond 2.5.1 or re-enable Markdown link scheme validation in the rendering config (VulnCheck advisory).