---
id: "CVE-2026-116047"
kind: "vulnerability"
aliases: ["CVE-2026-116047"]
title: "Vocechat: welcome query parameter in widget.html enables cross-site scripting"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "vocechat", "web"]
not_affected_if: ["unknown"]
published_at: "2026-10-25T08:16:26+00:00"
first_seen_at: "2026-10-25T08:39:36+00:00"
updated_at: "2026-10-25T08:39:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116047", "first_seen_at": "2026-10-25T08:39:36+00:00"}]
---

# Vocechat: welcome query parameter in widget.html enables cross-site scripting

Vocechat up to 0.9.121 does not properly handle the welcome query parameter in its widget.html page. A remote attacker can craft a link that runs script in a victim's browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Vocechat version and compare it with `0.9.121`
- Look for the widget.html page and whether it reads a welcome query parameter; unknown if the sources give a specific file path

## Fix

- Upgrade Vocechat to a version later than `0.9.121`; unknown if the sources name a fixed release
- Until patched, restrict access to the widget page or put a filter in front of it; unknown if the sources name a specific control

## Timeline

- 2026-10-25T08:39:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116047

## From the sources

A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_