{"data":{"id":"a865a925-f122-4fd8-830e-63a525a5b16d","title":"CVE-2026-24399: ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes…","summary":"ChatterMate, a no-code AI chatbot agent framework, versions 1.0.8 and below, accepts and executes malicious HTML/JavaScript supplied as chat input. An iframe payload containing a javascript: URI runs in the browser context, exposing client-side data such as localStorage tokens and cookies. The flaw is tracked as CVE-2026-24399 under CWE-79.","solution":"Fixed in version 1.0.9.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-24399","publishedAt":"2026-01-24T01:15:50.393Z","cveId":"CVE-2026-24399","cweIds":["CWE-79"],"cvssScore":"9.3","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ChatterMate"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ChatterMate client-side injection through iframe javascript URI in chat input","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00336,"epssCheckedAt":"2026-11-04T12:08:35.001Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T00:12:38.218Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}