Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-30048 — Stored XSS vulnerability in NotChatbot WebChat <=1.5.0 with PoC payloads, impact analysis, and remediation guidance for secure chat history rendering. | Kitploit
Tools/GitHubGitHub/0xn4no/cve-2026-30048
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPapers & Research
GitHub0xn4no/cve-2026-30048

CVE-2026-30048

Stored XSS vulnerability in NotChatbot WebChat <=1.5.0 with PoC payloads, impact analysis, and remediation guidance for secure chat history rendering.

View Repository
5 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-30048 - Stored Cross-Site Scripting (XSS) in NotChatbot WebChat <= 1.5.0

Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in the @developer.notchatbot/webchat package versions up to and including 1.5.0.

User-supplied input is not properly sanitized before being stored and rendered in the AI-powered chat conversation history. This allows an attacker to inject arbitrary JavaScript code that is executed when the chat history is rendered or reloaded.

Because the issue resides in the reusable WebChat component itself rather than in a single website implementation, any application integrating the vulnerable package version may be affected, regardless of deployment context.

Affected Product

  • Vendor: NotChatbot
  • Package: @developer.notchatbot/webchat
  • Affected Versions: Up to and including 1.5.0

Vulnerability Type

  • Stored Cross-Site Scripting (XSS)

Affected Component

  • WebChat message rendering
  • Conversation history rendering

Attack Vector

An attacker can send a crafted chat message containing malicious HTML/JavaScript payload.
The payload is stored and later executed when the conversation history is rendered again.

Proof of Concept (PoC)

Payloads

root@kitploit:~
root@kitploit:~
root@kitploit:~
</img>

Video Demonstration

https://youtu.be/HklaoNKP9H8

Steps to Reproduce

  1. Integrate the WebChat widget using the official package/CDN
  2. Open the chat interface
  3. Send the payload above as a chat message
  4. Reload or reopen the conversation
  5. Observe JavaScript execution in the browser

Impact

  • Arbitrary JavaScript execution in the victim’s browser
  • Session hijacking
  • Information disclosure
  • Potential account takeover depending on context

Root Cause

User input is rendered without proper output encoding or HTML sanitization in the chat history rendering logic.

Suggested Fix

  • Sanitize and escape user input before rendering
  • Use a secure sanitizer such as DOMPurify
  • Encode output by default
  • Implement a restrictive Content Security Policy (CSP)

CVE

CVE-2026-30048

References

  • https://www.npmjs.com/package/@developer.notchatbot/webchat
  • https://app.unpkg.com/@developer.notchatbot/[email protected]
  • https://app.unpkg.com/@developer.notchatbot/[email protected]
  • https://gist.github.com/0xN4no/0601f398942a29259d217ea650f694fe

Discoverer

  • Nano (@0xNano)
  • https://0xnano.com/

Timeline

  • Discovery: 2026-01
  • CVE Assigned: 2026-03
Download Tool