Cross-Site Scripting Vulnerability in NextChat Plugin Editor

CVE-2026-118132

What is CVE-2026-118132?

NextChat version 2.16.1 is affected by a client-side cross-site scripting (XSS) vulnerability within the Plugin Editor. This issue arises from the unsafe handling of OpenAPI plugin schema content that is fetched from an external source. Specifically, when a remote OpenAPI schema is loaded, the content is stored directly in plugin.content and subsequently rendered using React’s dangerouslySetInnerHTML method without adequate sanitization. An attacker could exploit this flaw by enticing users to load a malicious schema, enabling arbitrary JavaScript execution within the NextChat environment. This could potentially expose sensitive JavaScript-readable cookies and other critical client-side information tied to the NextChat application.

References