Summary

An authenticated user can inject a persistent JavaScript payload into a group chat message through the data.text parameter of the /v3.0/messages endpoint. The payload is stored by the platform and executes automatically in the browser of every group member who opens the conversation, with no interaction required.

Root cause

Message text sent through the group messaging endpoint is stored and later rendered to other members without contextual output encoding, so markup inside data.text is interpreted as HTML rather than shown as plain text.

Proof of concept

• As an authenticated member, send a message to a group with a scripted payload in data.text.
• The platform stores the message verbatim.
• Any member who opens the group renders the message and the payload executes in their session.

// crafted request with receiverType set to group
POST /v3.0/messages
{
  "receiverType": "group",
  "receiver": "<groupId>",
  "category": "message",
  "type": "text",
  "data": { "text": "<img src=x onerror=alert(document.domain)>" }
}

Impact

Arbitrary script execution in the session of every group member. This enables session and token theft, actions on behalf of the victim, and disclosure of conversation data. Reported as remote and authenticated with no victim interaction.

Disclosure

Responsibly disclosed to CometChat in February 2026 (request 42660) and tested on a dedicated application. The vendor acknowledged the report and marked it Solved. CVE assigned by MITRE.