CVE-2026-30048 - Vulnerability Analysis

Overview

NotChatbot WebChat widget <= 1.4.4 contains a stored XSS caused by improper sanitization of user input in chat conversation history, letting attackers inject and execute arbitrary JavaScript when chat history reloads, exploit requires no special conditions.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in users' browsers, leading to session hijacking or other malicious actions.

Mitigation

Update to the latest version beyond 1.4.4.

References

• https://app.unpkg.com/@developer.notchatbot/[email protected]
• https://gist.github.com/0xN4no/0601f398942a29259d217ea650f694fe
• https://github.com/0xN4no/CVE-2026-30048
• https://www.npmjs.com/package/@developer.notchatbot/webchat

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner