CVE-2026-30048: NotChatbot WebChat XSS Vulnerability in npm Package
Summary
CVE-2026-30048: NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability. Affects @developer.notchatbot/webchat versions < 1.5.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NotChatbot WebChat is a popular widget used for integrating chat functionalities into websites. It allows users to engage in real-time conversations, enhancing customer support and interaction. The package is designed to be easily customizable and is widely adopted across various platforms. However, a critical vulnerability has been identified that compromises the security of the chat history feature.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget through version 1.4.4. This vulnerability arises from the failure to properly sanitize user-supplied input before it is stored and rendered in the chat conversation history. As a result, an attacker can inject arbitrary JavaScript code, which is executed when the chat history is reloaded. This poses significant risks, including data theft, session hijacking, and the potential for further exploitation of the affected systems. The issue has been confirmed across multiple independent implementations, indicating that it is inherent to the product rather than isolated to specific configurations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input sanitization on your end to mitigate the risk of XSS attacks. You can use libraries such as DOMPurify to sanitize user inputs before rendering them in the chat history. Example code:
const cleanInput = DOMPurify.sanitize(userInput);
renderChatHistory(cleanInput);
Conclusion
The stored XSS vulnerability in the NotChatbot WebChat widget poses significant security risks to users and their data. It is crucial to update to the latest version of the package to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for @developer.notchatbot/webchat →
FAQ
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored on the server and executed when users access the affected content.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The consequences include unauthorized access to user data, session hijacking, and the ability to execute malicious scripts in the context of the affected user's session.
Yes, a patch is available in version 1.5.0 of the NotChatbot WebChat package. It is recommended to update to this version to mitigate the vulnerability.
Vulert is a tool that monitors and alerts users about open-source vulnerabilities in their software. It uses package-lock.json to provide real-time alerts without requiring code access or installation.
