PT-2026-26106 · Notchatbot · Notchatbot Webchat Widget

0Xn4No · Publicado 2026-03-18 · Atualizado 2026-03-19 · CVE-2026-30048

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NotChatbot WebChat widget versions through 1.4.4

Description A stored cross-site scripting (XSS) issue exists where user-provided input is not adequately sanitized before being stored and displayed in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code that executes when the chat history is reloaded. The vulnerability is present in multiple independent implementations of the widget, indicating a flaw within the product itself.

Recommendations Versions prior to 1.4.4 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-30048

GHSA-W3VX-52J6-9FJP

Produtos afetados

Notchatbot Webchat Widget

Referências · 7

• 🔥 https://github.com/0xN4no/CVE-2026-30048 · Exploit
• https://osv.dev/vulnerability/GHSA-w3vx-52j6-9fjp · Aviso do Fabricante
• https://npmjs.com/package/@developer.notchatbot/webchat · Nota
• https://app.unpkg.com/@developer.notchatbot/webchat@1.4.4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-30048 · Nota de Segurança
• https://gist.github.com/0xN4no/0601f398942a29259d217ea650f694fe · Nota
• https://twitter.com/CVEnew/status/2034520437384679672 · Publicação no Twitter