{"id":"CVE-2026-116047","kind":"vulnerability","aliases":["CVE-2026-116047"],"related":[],"title":"Vocechat: welcome query parameter in widget.html enables cross-site scripting","description":"A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Vocechat up to 0.9.121 does not properly handle the welcome query parameter in its widget.html page. A remote attacker can craft a link that runs script in a victim's browser session.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vocechat","web"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Vocechat version and compare it with `0.9.121`\n- Look for the widget.html page and whether it reads a welcome query parameter; unknown if the sources give a specific file path","fix":"- Upgrade Vocechat to a version later than `0.9.121`; unknown if the sources name a fixed release\n- Until patched, restrict access to the widget page or put a filter in front of it; unknown if the sources name a specific control","status":"open","published_at":"2026-10-25T08:16:26+00:00","first_seen_at":"2026-10-25T08:39:36+00:00","triaged_at":"2026-10-25T08:39:48+00:00","updated_at":"2026-10-25T08:39:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T08:39:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vocechat to a version later than `0.9.121`; unknown if the sources name a fixed release\n- Until patched, restrict access to the widget page or put a filter in front of it; unknown if the sources name a specific control","reach":"internet","title":"Vocechat: welcome query parameter in widget.html enables cross-site scripting","impact":"medium","summary":"Vocechat up to 0.9.121 does not properly handle the welcome query parameter in its widget.html page. A remote attacker can craft a link that runs script in a victim's browser session.","category":"package","nicknames":[],"who_cares":["vocechat","self-hosted","web"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs script in a victim's browser on the Vocechat site.","analyst_note":"Confirm the fixed version and whether widget.html is enabled by default; check the vendor or NVD references for a patch, since the vendor did not respond.","how_to_check":"- Check the installed Vocechat version and compare it with `0.9.121`\n- Look for the widget.html page and whether it reads a welcome query parameter; unknown if the sources give a specific file path","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Self-hosted Vocechat deployments at version 0.9.121 or earlier are exposed, since the flaw is in the widget.html page that reads the welcome parameter. Instances that do not run this version, or that do not serve widget.html, are likely not affected. The sources do not say whether a default configuration enables the page.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000623,"input_tokens":3342,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116047':14A,17A '-2026':13A,16A '0.9.121':27B,66C 'affect':69C 'argument':87C 'attack':42B,95C 'browser':54B 'compon':79C 'contact':115C 'craft':44B 'cross':9A,91C 'cross-sit':8A 'cve':12A,15A 'disclos':104C 'disclosur':119C 'earli':116C 'enabl':7A 'exploit':101C 'file':75C 'found':60C 'handl':31B 'handler':82C 'host':21B 'issu':68C 'launch':98C 'lead':89C 'link':46B 'manipul':84C 'may':109C 'packag':18B 'page':39B 'paramet':4A,35B,81C 'privoc':62C 'process':72C 'proper':30B 'public':107C 'queri':3A,34B,80C 'remot':41B,99C 'respond':123C 'run':48B 'script':11A,49B,93C 'self':20B 'self-host':19B 'session':55B 'site':10A,92C 'unknown':71C 'use':111C 'vendor':113C 'victim':52B 'vocechat':1A,22B,24B,63C 'vulner':57C 'way':126C 'web':23B 'welcom':2A,33B,88C 'widget.html':6A,38B,76C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Vocechat deployments at version 0.9.121 or earlier are exposed, since the flaw is in the widget.html page that reads the welcome parameter. Instances that do not run this version, or that do not serve widget.html, are likely not affected. The sources do not say whether a default configuration enables the page.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T08:16:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116047","severity":null,"published_at":"2026-10-25T08:16:26+00:00","modified_at":"2026-10-25T08:16:26+00:00","first_seen_at":"2026-10-25T08:39:36+00:00","fetched_at":"2026-10-25T08:39:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}