CVE-2026-7643: ChatGPTNextWeb NextChat permissive cross-domain policy via API endpoint

Summary

CVE-2026-7643 affects ChatGPTNextWeb NextChat up to 2.16.1, specifically an unknown function of the file Next.js in the API Endpoint component. Manipulating it can lead to a permissive cross-domain policy that trusts untrusted domains, and the attack may be launched remotely. The exploit has been published and may be used, and the project was informed through an issue report but has not responded yet.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News