PT-2025-42756 · Unknown · Tawk Live Chat

Published 2025-10-20 · Updated 2025-10-20 · CVE-2025-8349

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tawk Live Chat (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue exists in Tawk Live Chat. An attacker can execute JavaScript code in a victim’s browser by uploading a malicious PDF file containing a JavaScript payload through the chatbot. The application stores the PDF and displays it without proper sanitisation to other users, allowing for the execution of the malicious code. This could lead to the theft of sensitive user data, such as session cookies, or actions performed on behalf of the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-8349

Affected Products

Tawk Live Chat

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-8349 · Security Note
• https://t.me/CVEtracker/35302 · Telegram Post
• https://twitter.com/incibe_cert/status/1980207730494234715 · Twitter Post
• https://twitter.com/CVEnew/status/1980216992406606224 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1980219578018898317 · Twitter Post
• https://t.me/cveNotify/139371 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-stored-tawk-live-chat · Note