Stored Cross-Site Scripting Vulnerability in Chatwoot
CVE-2026-113355

4.8MEDIUM

Key Information:

Vendor

Chatwoot

Status
Chatwoot
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113355?

Chatwoot versions prior to 4.14.0 are susceptible to a stored cross-site scripting vulnerability that enables account administrators to insert malicious JavaScript through manipulated video-embed links in Help Center articles. This flaw arises from the improper handling of angle-bracket link destinations combined with double quotes, allowing attackers to bypass the unescaped iframe src attribute in render_embed_from_match. As a consequence, scripts may execute in the context of public visitors, which could result in the theft of cw_conversation widget tokens.

Affected Version(s)

chatwoot 0 < 4.14.0

References

https://github.com/chatwoot/chatwoot/pull/14140
patchissue-tracking
https://github.com/chatwoot/chatwoot/commit/2192af80f405c...
patch
https://github.com/chatwoot/chatwoot/releases/tag/v4.14.0
release-notes

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ostorlab
.