Is CVE-2026-113355 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113355 being exploited in the wild.

How severe is CVE-2026-113355?

Medium severity, with a CVSS score of 4.8, published 20 October 2026.

Is there a fix for CVE-2026-113355?

Yes: fixed in 4.14.0. Until then: Restrict Help Center article authoring permissions to trusted administrators only and audit existing Help Center articles for suspicious video embed URLs until the platform is upgraded. [{"kind": "disclosed", "at": "2026-10-20"}, {"kind": "patched", "at": "2026", "note": "Fix applied via commit 2192af8 which HTML-escapes captured values at substitution time"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113355 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-113355?

Check whether you run Chatwoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113355: Chatwoot stored cross-site scripting in Help Center embeds

CVE-2026-113355 · Severity: medium · CVSS 4.8 · Published 2026-10-20

Chatwoot is a customer communications platform that allows account administrators to create Help Center articles. A flaw in how the platform handles embedded video links allows administrators to inject malicious JavaScript into these articles, which then executes for public visitors and can steal session tokens used by the chat widget.

Technologies: Chatwoot. Vendors: Chatwoot.

Quick answers

Is CVE-2026-113355 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113355 being exploited in the wild.
How severe is CVE-2026-113355?: Medium severity, with a CVSS score of 4.8, published 20 October 2026.
Which products and versions are affected?: Chatwoot before 4.14.0.
Is there a fix for CVE-2026-113355?: Yes: fixed in 4.14.0. Until then: Restrict Help Center article authoring permissions to trusted administrators only and audit existing Help Center articles for suspicious video embed URLs until the platform is upgraded.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-20"}, {"kind": "patched", "at": "2026", "note": "Fix applied via commit 2192af8 which HTML-escapes captured values at substitution time"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113355 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-113355?: Check whether you run Chatwoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.14.0

Restrict Help Center article authoring permissions to trusted administrators only and audit existing Help Center articles for suspicious video embed URLs until the platform is upgraded.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-20"}, {"kind": "patched", "at": "2026", "note": "Fix applied via commit 2192af8 which HTML-escapes captured values at substitution time"}]

Technical details

A stored XSS vulnerability exists in the render_embed_from_match function within the custom markdown renderer. The vulnerability arises because regex-captured values from user-authored Help Center article URLs are interpolated into HTML iframe src attributes without escaping. An attacker with account administrator privileges can craft URLs using angle-bracket link syntax with unfiltered characters to break out of the iframe src attribute and inject arbitrary JavaScript. This executes in the context of public Help Center visitors and can compromise cw_conversation widget tokens.

Affected products

Chatwoot Chatwoot before 4.14.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.