CVE-2026-24399
Cross-Site Scripting in ChatterMate Allows Client Data Theft
Publication date: 2026-01-24
Last updated on: 2026-02-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chattermate | chattermate | to 1.0.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers to execute malicious scripts in users' browsers, leading to unauthorized access to sensitive client-side data such as localStorage tokens and cookies. Such unauthorized data access and potential account takeover can result in breaches of confidentiality and integrity of personal or sensitive information. Consequently, this poses significant risks to compliance with data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive data against unauthorized access and disclosure. Organizations using affected versions of ChatterMate may face compliance violations if this vulnerability is exploited before applying the fix. [2]
Can you explain this vulnerability to me?
CVE-2026-24399 is a critical Stored Cross-Site Scripting (XSS) vulnerability in the ChatterMate chatbot framework (versions 1.0.8 and below). The chatbot accepts and executes malicious HTML/JavaScript payloads submitted as chat input. Specifically, an attacker can inject an <iframe> element with a javascript: URI that executes in the browser context. This allows the attacker to run arbitrary JavaScript code, potentially stealing sensitive client-side data such as localStorage tokens and cookies. The vulnerability arises from improper sanitization of user input in the chatbot's rendering functions, enabling client-side injection and execution of malicious scripts. [2]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to sensitive client-side data like authentication tokens and cookies, which can lead to account takeover, especially of admin accounts. Attackers can execute arbitrary JavaScript code in the victim's browser, potentially including keystroke sniffers and other malicious payloads. This compromises the confidentiality and integrity of user data and can result in loss of trust, data breaches, and unauthorized actions performed on behalf of users. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring chat inputs for malicious HTML/JavaScript payloads, specifically looking for injected <iframe> elements with javascript: URI schemes. Detection can involve inspecting chat logs or network traffic for suspicious payloads. Since the vulnerability involves client-side execution, testing can be done by submitting known malicious payloads (e.g., <iframe src="javascript:alert(1)"></iframe>) in the chatbot input and observing if they execute. Additionally, reviewing frontend files such as widget_chat.py, ConversationChat.vue, and WidgetBuilder.vue for improper sanitization can help identify vulnerable versions. There are no specific commands provided in the resources, but using web application security testing tools or manual inspection of chat inputs for suspicious HTML/JavaScript content is recommended. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the ChatterMate application to version 1.0.9 or later, where the issue has been fixed. The fix includes enhanced input sanitization on both backend and frontend, removal of markdown links and images, blocking of dangerous HTML tags and attributes, and prevention of Cross-Site Scripting (XSS) attacks. Additionally, applying strict file upload validations and security hardening measures as implemented in version 1.0.9 will help mitigate the risk. Until the upgrade is applied, avoid accepting untrusted chat inputs or implement custom sanitization to block malicious HTML/JavaScript payloads. [1, 3]