Executive brief
NotChatbot WebChat is a popular React chatbot widget embedded on websites to provide customer conversations. A stored cross-site scripting (XSS) vulnerability allows attackers to inject malicious JavaScript code into chat messages, which is then executed whenever the chat history is loaded by other users. This can lead to session hijacking, credential theft, or malware distribution to visitors of affected websites.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) affecting NotChatbot WebChat through version 1.4.4. User-supplied input in chat messages is not properly sanitized before being stored in the chat conversation history and rendered on page load. An attacker can craft a malicious message payload containing arbitrary JavaScript that persists in the backend and executes in the browser context of any user who views that chat history. The attack requires no authentication and the vulnerability has been confirmed across multiple independent implementations, indicating a product-level flaw rather than a configuration issue. Patches are available in version 1.5.0 and later.
Affected products
- NotChatbot WebChat through 1.4.4
Timeline
- 2026-03-18: disclosed
- 2026-03-19: advisory