Vocechat CVE-2026-116047

Exploitation requires an authenticated or active Vocechat user to open an attacker-crafted link whose welcome query parameter targets the widget.html endpoint of the Query Parameter Handler component; the injected value is reflected into the page DOM and executed client-side. The limiting factors are the mandatory victim interaction (UI:P - the target must click/open the malicious URL) and the need for the widget.html endpoint to be reachable in the deployment; it does not yield direct server-side code execution. Affected versions are Vocechat up to and including 0.9.121, and no fixed version is listed in the available sources.

This is a medium-severity DOM-based cross-site scripting flaw (CWE-79) in Vocechat's widget.html via the welcome query parameter, carrying a CVSS 4.0 score of 5.3. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) shows a network-reachable, low-complexity issue requiring no privileges but DOES require victim interaction (UI:P) - a user must open an attacker-supplied link - and the impact is limited to low integrity on the vulnerable system with no confidentiality or availability loss recorded by the reporter. The vuln.today decision label is 'this_month', not act_now or emergency, which is consistent with a reflected/DOM XSS that depends on social engineering rather than mass, unauthenticated server compromise. No EPSS score and no CISA KEV status were provided in the input, so there is no signal of active exploitation or statistically-modeled exploitation probability to weigh. A public PoC reference exists (GitHub, Vocechat_DomXss.md) but it is not verified as working exploit code, so it should be treated as a disclosure pointer rather than a confirmed weapon. Net assessment: a genuine but modest-priority browser-side injection flaw - real because the technique is well understood, the product is unpatched (vendor non-responsive), and a disclosure exists, but bounded by the user-interaction requirement and the absence of KEV/EPSS escalation signals. Note: the reporter scored confidentiality impact as none (VC:N), yet DOM XSS commonly enables session/cookie theft, so the real confidentiality risk may be understated - verify against the actual injection sink.

An attacker crafts a URL to a victim organization's Vocechat widget.html containing a malicious payload in the welcome query parameter and delivers it via phishing, chat, or a malicious page. When a logged-in user opens the link, the parameter is reflected into the DOM without sanitization and the script executes in the user's browser session. A public PoC reference exists but is not verified as working exploit code.