CVE-2025-12246: Chatwoot XSS Vulnerability

CVE-2025-12246 Overview

CVE-2025-12246 is a cross-site scripting (XSS) vulnerability affecting Chatwoot versions up to 4.7.0. The flaw resides in the app/javascript/shared/components/IframeLoader.vue file within the Admin Interface component. Attackers can manipulate the Link argument to inject script content that executes in the context of the Chatwoot application.

The vulnerability is exploitable remotely and requires user interaction to trigger. According to the disclosure, the vendor was contacted early but did not respond. The weakness is categorized under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Remote attackers can inject client-side script into the Chatwoot Admin Interface, enabling session-context abuse against authenticated administrators through crafted Link values.

Affected Products

Chatwoot versions up to and including 4.7.0
Chatwoot Admin Interface component
app/javascript/shared/components/IframeLoader.vue

Discovery Timeline

2025-10-27 - CVE-2025-12246 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12246

Vulnerability Analysis

The vulnerability exists in the IframeLoader.vue component that renders iframes inside the Chatwoot Admin Interface. The component accepts a Link argument and passes it into the DOM without sufficient neutralization of active content. An attacker who controls or influences the Link value can supply a crafted URI scheme or embedded payload that runs as script when the iframe is loaded.

Because the flaw sits in a Vue single-file component used by the admin surface, script execution occurs under the origin of the Chatwoot instance. This grants the payload access to the authenticated session storage, tokens, and Document Object Model (DOM) of the console. Exploitation requires user interaction, such as visiting or previewing a page that instantiates the vulnerable component with attacker-influenced input.

The root category is client-side injection [CWE-79], and the impact is limited to integrity of loaded content rather than confidentiality or availability of the backend. See the Hckwr blog on Chatwoot vulnerabilities and VulDB entry #329917 for additional analysis.

Root Cause

The root cause is missing or insufficient sanitization of the Link parameter before it is used to construct an iframe source in IframeLoader.vue. The component trusts caller-supplied input and does not restrict the URI scheme, allowing schemes such as javascript: or embedded HTML entities to be interpreted as executable content.

Attack Vector

Exploitation occurs over the network and requires an administrator or privileged user to interact with a page or view that instantiates the vulnerable iframe loader with an attacker-controlled Link. The injected payload executes in the browser under the Chatwoot origin, giving the attacker the ability to read DOM data, forge admin requests, or pivot to further account manipulation.

No public proof-of-concept exploit is currently listed in Exploit-DB, and the CISA Known Exploited Vulnerabilities catalog does not include this CVE. The EPSS probability is 0.367% (28.79 percentile), indicating low near-term exploitation likelihood.

No verified exploitation code is available. Refer to the Hckwr technical write-up for reproduction details.

Detection Methods for CVE-2025-12246

Indicators of Compromise

Unexpected javascript:, data:, or vbscript: schemes appearing in URL parameters routed to Chatwoot admin views
Outbound requests from administrator browsers to unfamiliar domains shortly after loading admin conversation or settings pages
Anomalous session token or API key access from administrator sessions immediately after visiting Chatwoot views that render iframes

Detection Strategies

Inspect HTTP request logs for query parameters or body fields feeding the IframeLoader.vue component that contain script-like content or non-https: schemes
Enable Content Security Policy (CSP) reporting to capture blocked inline script attempts and unexpected iframe sources within the Chatwoot origin
Correlate admin browser telemetry with Chatwoot access logs to identify script execution following navigation to affected views

Monitoring Recommendations

Alert on any Chatwoot request whose Link or equivalent parameter contains javascript:, data:text/html, or encoded <script> fragments
Monitor for privilege changes, agent role modifications, and API token creation events that occur inside administrator sessions without matching interactive intent
Track browser console errors and CSP violation reports referencing IframeLoader.vue or iframe sources outside allowlisted domains

How to Mitigate CVE-2025-12246

Immediate Actions Required

Restrict access to the Chatwoot Admin Interface to trusted networks and enforce multi-factor authentication for all administrator accounts
Audit any custom integrations or automations that pass URLs into Chatwoot views, and reject non-https: schemes at the ingress layer
Deploy a strict Content Security Policy that disallows inline script execution and constrains frame-src to a known allowlist

Patch Information

As of the last NVD update on 2026-06-17, no vendor-issued patch is referenced in the advisory. The disclosure notes the vendor did not respond. Track the Chatwoot GitHub repository for future releases beyond 4.7.0 and apply any fix that hardens IframeLoader.vue input handling once available.

Workarounds

Place Chatwoot behind a reverse proxy that strips or rewrites Link parameters containing non-HTTP(S) schemes before they reach the application
Apply a Content Security Policy header such as default-src 'self'; script-src 'self'; frame-src 'self' https://trusted.example
Educate administrators to avoid clicking untrusted links inside the Chatwoot console until the component is remediated

bash

# Example nginx snippet enforcing CSP in front of Chatwoot
add_header Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  frame-src 'self' https://trusted.example; \
  object-src 'none'; \
  base-uri 'self'" always;