MEDIUM

GHSA-w3vx-52j6-9fjp

NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability

Details

A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code which is executed when the chat history is reloaded. The issue is reproducible across multiple independent implementations of the widget, indicating that the vulnerability resides in the product itself rather than in a specific website configuration.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@developer.notchatbot/webchat

Introduced in: 0

No fixed version published yet for @developer.notchatbot/webchat (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-30048[ADVISORY]
https://app.unpkg.com/@developer.notchatbot/webchat@1.4.4[WEB]
https://gist.github.com/0xN4no/0601f398942a29259d217ea650f694fe[WEB]
https://github.com/0xN4no/CVE-2026-30048[WEB]
https://www.npmjs.com/package/@developer.notchatbot/webchat[WEB]