CVE-2026-24399: Chattermate XSS Vulnerability

CVE-2026-24399 Overview

CVE-2026-24399 is a client-side injection vulnerability in ChatterMate, a no-code AI chatbot agent framework. Versions 1.0.8 and earlier accept and render malicious HTML and JavaScript payloads supplied through chat input. An attacker can submit an <iframe> payload containing a javascript: URI, which the browser then executes within the victim's session context. Successful exploitation grants access to sensitive client-side data, including localStorage tokens and cookies. The flaw is tracked as a Cross-Site Scripting (XSS) issue under [CWE-79]. ChatterMate addressed the vulnerability in version 1.0.9.

Critical Impact
Attackers can exfiltrate session tokens and cookies from authenticated ChatterMate users by injecting javascript: URIs through chat inputs.

Affected Products

ChatterMate 1.0.8 and earlier
ChatterMate self-hosted deployments
ChatterMate frontend chat widget

Discovery Timeline

2026-01-24 - CVE-2026-24399 published to NVD
2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-24399

Vulnerability Analysis

The vulnerability resides in ChatterMate's chat message sanitization logic across both backend and frontend layers. User-supplied chat content is processed and rendered as HTML in the browser without sufficient filtering of dangerous tags and URI schemes. When an <iframe> element with a javascript: URI is sent as chat input, the browser executes the embedded script in the application origin. This grants the attacker read access to localStorage, session cookies, and any other client-accessible state. Because the chatbot interface is the primary user touchpoint, the payload reaches victims through normal chat interactions.

Root Cause

The sanitization routines in backend/app/utils/sanitize.py and frontend/src/utils/sanitize.ts failed to strip markdown link and image syntax before marked.js processed messages on the frontend. Anchor (<a>) and image (<img>) elements survived sanitization, allowing JavaScript URI schemes to remain in the rendered DOM. The browser then evaluated the javascript: URI on user interaction or auto-loading content.

Attack Vector

An authenticated low-privilege user submits a crafted chat message containing an <iframe> with a javascript: URI. When the message is rendered in another user's browser, the payload executes in the ChatterMate origin and reads sensitive client-side data.

python

     if not message:
         return message
     
-    # First, decode any encoded content to catch obfuscated attacks
+    # SECURITY LAYER 1: Remove markdown link and image syntax to prevent injection
+    # This must happen BEFORE marked.js processes it on the frontend
+    # Pattern matches: [text](url) including nested brackets
+    message = re.sub(r'\[([^\]]+)\]\([^\)]+\)', r'\1', message)
+    
+    # SECURITY: Remove markdown image syntax ![alt](url) - capture alt text without the !
+    message = re.sub(r'!\[([^\]]*)\]\([^\)]+\)', r'\1', message)
+    
+    # SECURITY: Remove reference-style markdown links [text][ref]
+    message = re.sub(r'\[([^\]]+)\]\[[^\]]+\]', r'\1', message)
+    
+    # SECURITY: Remove link reference definitions [ref]: url
+    message = re.sub(r'^\[[^\]]+\]:\s*.+$', '', message, flags=re.MULTILINE)
+    
+    # SECURITY LAYER 2: Decode any encoded content to catch obfuscated attacks
     decoded_message = decode_entities(message)
     
     # Check for encoded javascript: or data: URIs in decoded content

Source: GitHub Commit ff33980 — this patch adds multi-layer regex stripping of markdown link and image syntax in the backend sanitizer before marked.js rendering occurs.

Detection Methods for CVE-2026-24399

Indicators of Compromise

Chat messages containing <iframe> tags or javascript: URI schemes in stored conversation logs.
Outbound HTTP requests from browser sessions to attacker-controlled domains referencing localStorage keys or cookie values.
Unexpected access patterns to authenticated ChatterMate API endpoints using stolen session tokens.

Detection Strategies

Inspect chat message databases for markdown patterns such as [text](javascript:...) or ![alt](javascript:...).
Deploy Content Security Policy (CSP) violation reporting to catch inline script execution attempts in the chat widget.
Review web server access logs for chat submission payloads matching <iframe, javascript:, or data:text/html strings.

Monitoring Recommendations

Alert on anomalous browser-originated requests carrying ChatterMate session tokens from unusual geographies or user agents.
Track ChatterMate version strings across deployments to confirm all instances run 1.0.9 or later.
Monitor for repeated failed sanitization attempts or sanitizer exceptions in application logs.

How to Mitigate CVE-2026-24399

Immediate Actions Required

Upgrade all ChatterMate deployments to version 1.0.9 or later without delay.
Invalidate active session tokens and force user re-authentication after upgrading.
Audit stored chat history for malicious payloads and purge any confirmed injection attempts.

Patch Information

The fix is included in ChatterMate v1.0.9 via commit ff33980. The patch strengthens both backend (sanitize.py) and frontend (sanitize.ts) sanitization by removing markdown link and image syntax server-side and registering a DOMPurify uponSanitizeElement hook that strips <a>, <img>, <area>, and <map> elements client-side. See the GitHub Security Advisory GHSA-72p3-w95w-q3j4 for full vendor guidance.

Workarounds

Apply a strict Content Security Policy that disallows inline scripts and restricts iframe sources to a vetted allowlist.
Place the chat widget behind a reverse proxy that filters chat submissions containing <iframe>, javascript:, or data: URI schemes.
Store session tokens in HttpOnly cookies rather than localStorage to limit data accessible to injected scripts.

bash

# Configuration example: upgrade ChatterMate to the patched release
git fetch --tags
git checkout v1.0.9
# Rebuild and redeploy the application
docker compose build --no-cache
docker compose up -d
# Verify the patched sanitizer is active
grep -n "SECURITY LAYER 1" backend/app/utils/sanitize.py