中
4.8
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account...
CVE-2026-113355
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
出典: NIST National Vulnerability Database NVD GitHub Advisory