{"id":"CVE-2026-113355","kind":"vulnerability","aliases":["CVE-2026-113355"],"related":[],"title":"Chatwoot: Help Center video links let admins inject scripts into public pages","description":"Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.","summary":"Chatwoot versions before 4.14.0 do not escape the iframe src attribute built from video-embed links in Help Center articles. An account administrator can craft a link that breaks out of the attribute and runs JavaScript for public visitors, which can steal cw_conversation widget tokens.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chatwoot","help-center","package","self-hosted"],"not_affected_if":["help-center-unused","version-4.14.0-or-later"],"how_to_check":"- Check the installed Chatwoot version, for example with `git describe --tags` in the deployment directory or the version shown in the admin settings.\n- Look for the render_embed_from_match helper in the Chatwoot source to confirm the unescaped iframe src.","fix":"- Upgrade Chatwoot to `4.14.0` or later.","status":"open","published_at":"2026-10-20T11:17:19+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:33:25+00:00","updated_at":"2026-10-25T04:33:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:33:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Chatwoot to `4.14.0` or later.","reach":"internet","title":"Chatwoot: Help Center video links let admins inject scripts into public pages","impact":"medium","summary":"Chatwoot versions before 4.14.0 do not escape the iframe src attribute built from video-embed links in Help Center articles. An account administrator can craft a link that breaks out of the attribute and runs JavaScript for public visitors, which can steal cw_conversation widget tokens.","category":"package","nicknames":[],"who_cares":["chatwoot","self-hosted","help-center"],"confidence":0.7,"needs_auth":"yes","worst_case":"Public visitors' browsers run attacker script and widget tokens leak.","analyst_note":"","how_to_check":"- Check the installed Chatwoot version, for example with `git describe --tags` in the deployment directory or the version shown in the admin settings.\n- Look for the render_embed_from_match helper in the Chatwoot source to confirm the unescaped iframe src.","needs_analyst":false,"not_affected_if":["version-4.14.0-or-later","help-center-unused"],"who_is_affected":"Self-hosted or cloud Chatwoot instances running a version before 4.14.0 that use the Help Center articles feature. The risk comes from administrators who can publish articles and from the public pages that render them, so single-admin or no-Help-Center installs have less exposure. Teams on 4.14.0 or later can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000609,"input_tokens":3356,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113355':15A,18A '-2026':14A,17A '4.14.0':30B,76C 'account':49B,87C 'admin':7A 'administr':50B,88C 'allow':86C 'angl':106C 'angle-bracket':105C 'articl':47B,101C 'attack':102C 'attribut':37B,60B,121C 'bracket':107C 'break':56B,114C 'built':38B 'center':3A,22B,46B,100C 'chatwoot':1A,19B,27B,74C 'contain':77C 'convers':71B,135C 'craft':52B,93C 'cross':81C 'cross-sit':80C 'cve':13A,16A 'cw':70B,134C 'destin':109C 'doubl':111C 'emb':42B,96C,124C 'escap':33B 'execut':127C 'help':2A,21B,45B,99C 'help-cent':20B 'host':26B 'ifram':35B,119C 'inject':8A,90C 'javascript':63B,91C 'let':6A 'link':5A,43B,54B,97C,108C 'match':126C 'packag':23B 'page':12A 'public':11A,65B,130C 'quot':112C 'render':123C 'run':62B 'script':9A,83C,128C 'self':25B 'self-host':24B 'site':82C 'src':36B,120C 'steal':69B,133C 'store':79C 'token':73B,137C 'unescap':118C 'use':104C 'version':28B 'video':4A,41B,95C 'video-emb':40B,94C 'visitor':66B,131C 'vulner':84C 'widget':72B,136C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud Chatwoot instances running a version before 4.14.0 that use the Help Center articles feature. The risk comes from administrators who can publish articles and from the public pages that render them, so single-admin or no-Help-Center installs have less exposure. Teams on 4.14.0 or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113355","severity":null,"published_at":"2026-10-20T11:17:19+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}