National Cyber Warfare Foundation (NCWF)

CVE-2026-24399

0 user ratings

2026-01-22 00:00:00
milo
CVEs
- archive --

CVE-2026-24399

Date: 2026-01-22

ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supplied as chat input. Specifically, an payload containing a javascript: URI can be processed and executed in the browser context. This allows access to sensitive client-side data such as localStorage tokens and cookies, resulting in client-side injection. This issue has been fixed in version 1.0.9.</p><br><br><h5>References:</h5><br><ul><li><a href='https://github.com/chattermate/chattermate.chat/security/advisories/GHSA-72p3-w95w-q3j4'>x_refsource_CONFIRM</a></li><li><a href='https://github.com/chattermate/chattermate.chat/commit/ff3398031abb97ae28546eaf993fed3619eaffdd'>x_refsource_MISC</a></li><li><a href='https://github.com/chattermate/chattermate.chat/releases/tag/v1.0.9'>x_refsource_MISC</a></li></ul></div><hr><br><table class='table table-striped'><tbody><tr><td><h5>Comments</h5></td><td><a href='post.php?p=VvrPmwePZN&o=e&c=new' class='btn btn btn-dark' role='button'>new comment</a></td></tr><tr><td>Nobody has commented yet. Will you be the first?</td><tr></tbody></table> <script type='text/javascript' src='nicEdit-latest.js'></script> <script type='text/javascript'> //<![CDATA[ bkLib.onDomLoaded(function() { bkLib.onDomLoaded(nicEditors.allTextAreas); }) //]]> </script> </div></td> <td width="1%"> </td> <td style="padding:10px" width="15%" valign="top" bgcolor="#C0C0C0"> <table class='table'><tr><td><b>Forum</b></td></tr><tr><td><a href='forum.php?f=GuWWnYzsIt'>CVEs</a></td></tr></table></td> </tr> </table> </font> <br><br><hr> <center>Copyright 2012 through 2026 - <a href='https://ncwf.io' target=_blank>National Cyber Warfare Foundation</a> - All rights reserved worldwide.</center> </body> </html>