CVE-2026-113355 json
Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
published 20d ago modified 20d ago also EUVD-2026-104926
- cvss
- 4.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
Patch / fix
- chatwoot chatwoot 4.14.0
- github.com/chatwoot/chatwoot@2192af8 commit
- github.com/chatwoot/chatwoot#14140 pull request
- github.com/chatwoot/chatwoot/releases/tag/v4.14.0 release
Is CVE-2026-113355 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20d ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- chatwoot chatwoot
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/chatwoot/chatwoot/pull/14140
patch, issue-tracking
-
github.com
/chatwoot/chatwoot/commit/2192af80f405c70e3021191ff8b3f7e539c35e9d
patch
-
github.com
/chatwoot/chatwoot/releases/tag/v4.14.0
release-notes
-
github.com
/chatwoot/chatwoot/blob/88ffa329eb6e18ae06b608d8b4bab96c0e1b8f44/lib/custom_markdown_renderer.rb#L75-L84
technical-description
-
vulncheck.com
/advisories/chatwoot-before-4.14.0-stored-xss-via-help-center-video-embed-links
third-party-advisory
Sources
- CVE List CVE-2026-113355
- NVD CVE-2026-113355
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.