Live › vulnerability › CVE-2026-118129
Go to dashboardChitchatter's postMessage handler in src/Bootstrap.tsx accepts configuration messages from an improperly validated parentDomain argument, so authentication can be bypassed. A remote attacker can send forged configuration messages, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 00:29 UTC. All times on this page are UTC.
Deployments of Chitchatter up to commit are affected, because the postMessage handler does not properly validate the parentDomain argument. Teams running a current build that includes the fix commit can skip it. The sources do not say what configuration an attacker gains by forging the message.
f82538633813c854a81a8b2112a2f6ba17b39cbcNo product ranges from the sources yet.
e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688 (for example, git merge-base --is-ancestor e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688 HEAD in the deployed checkout)isConfigMessageEvent in src/Bootstrap.tsx for the parentDomain checke3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in improper authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
This page as .md · .json · in your agent: get_signal("CVE-2026-118129")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.