Microsoft SimpleChat EUVD-2026-93427

Requires an authenticated group member holding Owner, Admin, or DocumentManager role to upload a document with an attacker-controlled filename via POST /api/group_documents/upload; apostrophes/HTML entities in the filename terminate the inline Share onclick handler string. Payload execution additionally requires a second group member to click the Share control on the malicious document (per the fix doc, the tooltip-attribute variant can also trigger on hover and reach ordinary group Users). Limiting factors: attacker must be an authenticated, privileged group member (not a general public user), the target deployment must be SimpleChat prior to 0.261.029, and victim interaction (Share click or hover) is needed before the script runs.

This is a stored (persistent) cross-site scripting flaw (CWE-79) scored CVSS 8.7 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. The high score is driven by the scope change (S:C) and high confidentiality/integrity impact typical of XSS executing in a victim's authenticated session. However, several signals temper the real-world urgency: PR:L confirms the attacker must already be an authenticated group member - and the description further narrows this to a group Owner, Admin, or DocumentManager who can upload documents - while UI:R means a second victim user must click the Share control before the payload fires. No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV status is absent, so there is no confirmed active exploitation; exploitation status is best characterized as no public exploit identified at time of analysis (the only external artifacts are the GitHub Security Advisory GHSA-qwcw-r653-j8c6 and the fix commit, i.e. patch metadata, not exploit code). Net assessment: a genuine, well-documented stored XSS with a credible privileged-insider threat model, but the required privileged role plus victim interaction make it a lower practical priority than the raw 8.7 suggests - closer to a targeted-abuse / malicious-insider risk than mass remote exploitation. Note one nuance the fix documentation adds beyond the NVD description: a tooltip-attribute injection path on hover can affect even ordinary group Users who cannot share documents, slightly broadening the victim-trigger surface relative to the Share-click path implied by the CVSS UI:R metric.

A malicious or compromised group Owner/Admin/DocumentManager uploads a document whose filename contains a crafted payload that breaks out of the inline onclick handler string (apostrophes survive escapeGroupHtml, and escapeHtml-produced entities are decoded by the browser before the handler is compiled). When another group member later opens the group workspace and clicks Share on that document, the script executes in the SimpleChat origin under the victim's session, enabling theft of victim-visible data and actions on the victim's behalf. No public exploit code is identified, but the GitHub advisory and fix commit precisely describe the injection mechanism.