XSS in Microsoft Simplechat
CVE-2026-105798
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that group_workspaces.html later interpolates into inline Share event handlers. The escapeGroupHtml function leaves apostrophes unchanged, while escapeHtml produces an HTML entity that the browser decodes before JavaScript evaluation, so either path permits the filename to terminate the handler string. An authenticated group Owner, Admin, or DocumentManager can persist script that executes in the SimpleChat origin when another group member clicks Share, allowing access to victim-visible data and actions with the victim session. This issue is fixed in version 0.261.029.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Microsoft Simplechat — versions < 0.261.029
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-105798?
- CVE-2026-105798 is a high-severity vulnerability in Microsoft Simplechat, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-10-06.
- How severe is CVE-2026-105798?
- High severity. CVSS v3 base score is 8.7 out of 10.