PT-2025-30419 · Telegai · Telegai

Published 2025-07-22 · Updated 2025-07-22 · CVE-2025-51860

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TelegAI (affected versions not specified)

Description The application contains a stored cross-site scripting (XSS) issue in its chat component and character container component. An attacker can execute arbitrary client-side scripts by creating an AI Character with SVG XSS payloads within the description, greeting, example dialog, or system prompt. This allows the LLM to embed XSS payloads in its chat response. When a user interacts with a malicious AI Character or views its profile, the script executes in the user's browser, potentially leading to the theft of sensitive information, such as session tokens, and account hijacking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-51860

Affected Products

Telegai

References · 3

• 🔥 https://github.com/Secsys-FDU/CVE-2025-51860 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-51860 · Security Note
• https://twitter.com/CVEnew/status/1947677514899292160 · Twitter Post