Threats tagged 'ghsa-whxc-wj8p-jg38'

NextChat version 2.16.1 has a client-side cross-site scripting (XSS) vulnerability in its Plugin Editor. This flaw arises from unsafe rendering of externally supplied OpenAPI plugin schema content without proper sanitization. An attacker can craft a malicious OpenAPI schema hosted remotely and trick a user into loading it, leading to arbitrary JavaScript execution within the NextChat application context. Exploitation could expose JavaScript-readable cookies and other client-side data tied to NextChat.