Chattermate vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Chattermate products: 1 record(s), with severity, exploitation and fixes.

Chattermate 1 Chattermate.chat 1

Exploited only (KEV) →

CVE-2026-24399 Medium · 5.4 CWE-79 Jan 23, 2026

ChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input Execution

ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supplied as chat input. Specifically, an <iframe> payload containing a javascript: URI can be processed and executed in the browser context. This allows access to sensitive client-side data such as localStorage tokens and cookies, resulting in client-side injection. This issue has been fixed in version 1.0.9.