defineid/wildfireCVE-2026-39154 · Stored XSS in CometChat JS SDK
Stored cross site scripting. CWE 79. CometChat JS SDK 3.0.12. Disclosed February 2026 as request 42660. The vendor marked it Solved. CVE assigned by MITRE.
An authenticated user injects a persistent JavaScript payload into a group message. The vector is the data.text parameter of the /v3.0/messages endpoint. The platform stores the payload. It executes in the browser of every group member who opens the conversation. No victim interaction is required.
Message text sent through the group endpoint is stored and later rendered to other members without contextual output encoding. Markup inside data.text is interpreted as HTML rather than shown as plain text.
The payloads sit in the conversation and are stored by the platform.
Opening the conversation runs the payload on the CometChat origin.
payload.txt holds the crafted request. Send it as an authenticated member of a group you own. Open the conversation as any member. The script runs in that session. A full video proof of concept was provided to the vendor during disclosure.
Arbitrary script execution in the session of every group member. Session and token theft. Actions on behalf of the victim. Disclosure of conversation data.
Contextually output encode or sanitize data.text before rendering it to other members. Test only against an application you own.
Abdulaziz Alasaiqah · https://azoz.my/writeups.html
