CVE-2026-4765: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in RD Station Conversas Tallos Chat

This vulnerability is a stored cross-site scripting (CWE-79) in the RD Station Conversas Tallos Chat product. It arises from improper neutralization of user input in the 'name' parameter during the chat initialization process. Because the malicious script is stored, it executes when support agents join the conversation, allowing arbitrary JavaScript execution within the application context. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and low scope and impact metrics. No known exploits in the wild have been reported. The vendor has not provided a patch or official remediation guidance as of the published date.

Successful exploitation allows arbitrary JavaScript code execution in the context of the affected application, potentially leading to session hijacking, unauthorized actions, or data exposure within the chat environment. The impact is increased because the malicious script executes in the browsers of support agents who join the conversation, potentially compromising their sessions or data. The CVSS score of 5.1 reflects a medium impact level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input in the 'name' parameter and consider implementing additional input validation or sanitization controls at the application or network level. Monitoring for suspicious activity related to chat sessions may help detect exploitation attempts.