CVE-2026-24399

ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supplied as chat input. Specifically, an <iframe> payload containing a javascript: URI can be processed and executed in the browser context. This allows access to sensitive client-side data such as localStorage tokens and cookies, resulting in client-side injection. This issue has been fixed in version 1.0.9.

• CWE-79

• https://github.com/chattermate/chattermate.chat/commit/ff3398031abb97ae28546eaf993fed3619eaffddPatch
• https://github.com/chattermate/chattermate.chat/releases/tag/v1.0.9Product, Release Notes
• https://github.com/chattermate/chattermate.chat/security/advisories/GHSA-72p3-w95w-q3j4Exploit, Vendor Advisory

Published

Jan 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24389Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-2439Concierge::Sessions versions from 0.8.1 before 0.8.5 for Per…9.8
• CVE-2026-24390Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2026-24391Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-24392Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2026-24398Hono is a Web application framework that provides support fo…6.5
• CVE-2026-2440The SurveyJS plugin for WordPress is vulnerable to Stored Cr…7.2
• CVE-2026-24400AssertJ provides Fluent testing assertions for Java and the …9.1
• CVE-2026-24401Avahi is a system which facilitates service discovery on a l…6.5
• CVE-2026-24402Rejected reason: GitHub cannot issue a CVE for this Security…
• CVE-2026-24403iccDEV provides libraries and tools for interacting with, ma…8.8
• CVE-2026-24404iccDEV provides libraries and tools for interacting with, ma…8.8