EUVD-2026-43337Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS executes in support agent's browser (scope change S:C); no privileges or special conditions required beyond initiating a public chat session.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
1DescriptionCVE.org
Stored Cross-Site Scripting (XSS) vulnerability in the RD Station Conversas chat. The vulnerability resides in the ‘name’ parameter of the initialization process due to improper sanitization of user input. The vulnerability is not limited to self-exploitation: when a support agent joins the conversation, the malicious script also executes in their browser, increasing the impact. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code within the context of the application.
AnalysisAI
Stored XSS in Tallos Chat (RD Station Conversas) allows unauthenticated attackers to inject persistent malicious JavaScript via the 'name' parameter during chat session initialization. The payload executes not only in the initiating visitor's browser but also in the browser of any support agent who joins the conversation, expanding the attack surface to privileged operator sessions within the platform. No public exploit code or active exploitation has been confirmed at time of analysis, and no EPSS data was provided.
Technical ContextAI
The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) flaw in the chat initialization flow of Tallos Chat, a customer support chat component of the RD Station Conversas platform (CPE: cpe:2.3:a:rd_station_conversas:tallos_chat:*:*:*:*:*:*:*:*). The 'name' parameter accepted during session setup is stored by the backend without adequate HTML encoding or sanitization, and is later rendered verbatim in the browser of all participants in the conversation thread. The stored nature means the payload persists and fires for every browser session that renders that chat thread - critically including support agents who open the conversation in response to an inquiry.
RemediationAI
No vendor-released patch or specific fixed version has been independently confirmed from the available data; organizations should contact RD Station Conversas directly and monitor the INCIBE advisory for patch release information: https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-tallos-chat-rd-station-conversas. As a compensating control, deploying a strict Content Security Policy (CSP) header on the domain serving the Tallos Chat widget can prevent injected scripts from executing even if the payload is stored - note that an overly restrictive CSP may break legitimate chat widget functionality and requires careful tuning. WAF rules blocking script-injection characters (angle brackets, event-handler patterns) in the chat name field provide an additional layer, though WAF bypass via encoding remains a risk. Restricting agent access to only process chats through hardened, session-isolated browsers reduces the blast radius if the agent-side execution vector is exploited.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today