Live › vulnerability › CVE-2026-113355
Go to dashboardChatwoot versions before 4.14.0 do not escape the iframe src attribute built from video-embed links in Help Center articles. An account administrator can craft a link that breaks out of the attribute and runs JavaScript for public visitors, which can steal cw_conversation widget tokens.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or cloud Chatwoot instances running a version before 4.14.0 that use the Help Center articles feature. The risk comes from administrators who can publish articles and from the public pages that render them, so single-admin or no-Help-Center installs have less exposure. Teams on 4.14.0 or later can skip it.
No product ranges from the sources yet.
git describe --tags in the deployment directory or the version shown in the admin settings.4.14.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
This page as .md · .json · in your agent: get_signal("CVE-2026-113355")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.