Summary

An authenticated user can inject a persistent JavaScript payload into a group chat message through the data.text parameter of the /v3.0/messages endpoint. The payload is stored by the platform and, with no further action from the attacker after delivery, executes automatically in the browser of any group member who opens that conversation.

Root cause

Message text sent through the group messaging endpoint is stored and later rendered to other members without contextual output encoding, so markup inside data.text is interpreted as HTML rather than shown as plain text.

Proof of concept

• As an authenticated member, send a message to a group with a scripted payload in data.text.
• The platform stores the message verbatim.
• Any member who opens the group renders the message and the payload executes in their session.

// crafted request with receiverType set to group
POST /v3.0/messages
{
  "receiverType": "group",
  "receiver": "<groupId>",
  "category": "message",
  "type": "text",
  "data": { "text": "<img src=x onerror=alert(document.domain)>" }
}

Tools

• The CometChat messaging widget and a crafted POST to /v3.0/messages to place the payload in data.text of a group message.
• A browser to observe the stored payload execute when a member opens the group.
• A local, offline stand-in of the SDK render sink (repro.html served over python3 -m http.server) to reproduce the behaviour safely with synthetic data.

Impact

Arbitrary script execution in the session of any group member who opens the affected conversation. Depending on the application's cookie and token protections, this could potentially enable session or token theft, actions on behalf of the victim, and disclosure of conversation data; the proof of concept demonstrated script execution (alert(document.domain)), not extraction of a live session or token. Self-assessed CVSS 3.1 8.7 High (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N); remote and authenticated, no interaction needed from the attacker after delivery, and the UI:R reflects that a victim must open the conversation for the stored payload to run. NVD has not scored it yet.

Disclosure

Responsibly disclosed to CometChat in February 2026 (request 42660) and tested on a dedicated application. The vendor acknowledged the report and marked it Solved. CVE assigned by MITRE.