ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supplied as chat input. Specifically, an <iframe> payload containing a javascript: URI can be processed and executed in the browser context. This allows access to sensitive client-side data such as localStorage tokens and cookies, resulting in client-side injection. This issue has been fixed in version 1.0.9.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 24 Jan 2026 09:45:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supplied as chat input. Specifically, an <iframe> payload containing a javascript: URI can be processed and executed in the browser context. This allows access to sensitive client-side data such as localStorage tokens and cookies, resulting in client-side injection. This issue has been fixed in version 1.0.9. | |
| Title | ChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input Execution | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-01-24T00:05:37.246Z
Reserved: 2026-01-22T18:19:49.172Z
Link: CVE-2026-24399
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-24T01:15:50.393
Modified: 2026-01-24T01:15:50.393
Link: CVE-2026-24399
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses