CVE-2026-30048: NotChatbot WebChat Widget XSS Vulnerability

CVE-2026-30048 Overview

CVE-2026-30048 is a stored cross-site scripting (XSS) vulnerability in the NotChatbot WebChat widget through version 1.4.4. The widget fails to sanitize user-supplied input before storing and rendering it in the chat conversation history. Attackers can inject arbitrary JavaScript that executes when victims reload the chat history. The flaw is reproducible across multiple independent deployments of the widget, confirming the defect resides in the product rather than in individual site configurations. The vulnerability is tracked under [CWE-79] and affects the @developer.notchatbot/webchat package distributed via npm.

Critical Impact
Attackers can execute arbitrary JavaScript in the browsers of users viewing the chat history, enabling session theft, credential harvesting, and client-side action hijacking.

Affected Products

@developer.notchatbot/webchat npm package versions through 1.4.4
Websites embedding the NotChatbot WebChat widget
Independent implementations of the widget across multiple deployments

Discovery Timeline

2026-03-18 - CVE-2026-30048 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-30048

Vulnerability Analysis

The NotChatbot WebChat widget persists chat messages and replays them when a conversation history is reloaded. During rendering, the widget injects stored message content into the DOM without applying output encoding or sanitization. An authenticated user with permission to submit chat messages can embed JavaScript payloads inside message fields. Those payloads are stored server-side and executed in every browser session that subsequently loads the conversation history. Because the script executes in the context of the embedding website, it inherits access to cookies, session tokens, and the same-origin DOM. The scope change reflected in the advisory indicates the injected code can affect resources beyond the widget itself, including the parent page that hosts it.

Root Cause

The defect is a failure to neutralize special characters in user-controlled chat content before rendering [CWE-79]. The widget treats stored message bodies as trusted HTML during the replay path. No contextual output encoding is applied, and no Content Security Policy enforcement is performed inside the widget.

Attack Vector

An attacker with low-privileged access submits a chat message containing an HTML or JavaScript payload. The server stores the payload verbatim. When any user reloads the chat session, the widget injects the payload into the page and the browser executes it. Exploitation requires user interaction in the form of reloading or opening the chat history. Technical details and a proof-of-concept payload are available in the GitHub Gist Code Snippet and the GitHub CVE-2026-30048 repository.

Detection Methods for CVE-2026-30048

Indicators of Compromise

Stored chat messages containing <script>, onerror, onload, or javascript: substrings in the NotChatbot message store.
Outbound browser requests to attacker-controlled domains originating from pages hosting the WebChat widget.
Unexpected DOM mutations or new event listeners attached after the chat widget loads conversation history.

Detection Strategies

Inspect the message store and message-rendering endpoints for HTML-encoded or raw script tags inside chat content fields.
Deploy Content Security Policy reporting on pages embedding the widget and monitor script-src violations.
Review browser telemetry and Web Application Firewall logs for chat submission requests containing script payloads.

Monitoring Recommendations

Alert on chat submissions whose payloads contain HTML event handler attributes or script delimiters.
Monitor for anomalous session-cookie exfiltration from origins that embed the @developer.notchatbot/webchat package.
Track installed versions of the @developer.notchatbot/webchat dependency across build pipelines and flag versions at or below 1.4.4.

How to Mitigate CVE-2026-30048

Immediate Actions Required

Audit all web properties that embed the NotChatbot WebChat widget and inventory the deployed package version.
Disable or remove the widget on production sites until a fixed release is deployed, if business operations permit.
Purge stored chat history that contains untrusted user content to remove dormant payloads.
Enforce a strict Content Security Policy that blocks inline scripts on pages hosting the widget.

Patch Information

No vendor-supplied patch is referenced in the NVD entry at the time of writing. Monitor the NPM Package Details page and the Unpkg Package Version listing for a release above 1.4.4 that addresses the issue.

Workarounds

Apply server-side input filtering that strips HTML tags and JavaScript event handlers from chat submissions before storage.
Wrap the widget in an iframe sandbox with the allow-scripts flag removed where the chat replay path cannot be trusted.
Deploy a Content Security Policy with script-src 'self' and no unsafe-inline directive on pages embedding the widget.
Implement output encoding at the reverse proxy or WAF layer for responses returning chat history JSON.

bash

# Example Content Security Policy header for pages embedding the widget
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";