CVE-2021-3741— Stored Cross-site Scripting (XSS) in chatwoot/chatwoot
Quick assessment
Affected
chatwoot chatwoot/chatwoot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Chatwoot是Chatwoot开源的一个应用软件。客户参与套件，对讲、Zendesk、Salesforce 服务云等的开源替代方案。 Chatwoot 2.6.0之前版本存在跨站脚本漏洞，该漏洞源于存在存储型跨站脚本（XSS）漏洞，攻击者可以通过上传包含恶意XSS载荷的SVG文件执行JavaScript代码。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-3741
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stored Cross-site Scripting (XSS) in chatwoot/chatwoot
Source: CVE Program / CVE List V5
Vulnerability Description
A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed, leading to potential security risks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
chatwoot 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Chatwoot是Chatwoot开源的一个应用软件。客户参与套件，对讲、Zendesk、Salesforce 服务云等的开源替代方案。 Chatwoot 2.6.0之前版本存在跨站脚本漏洞，该漏洞源于存在存储型跨站脚本（XSS）漏洞，攻击者可以通过上传包含恶意XSS载荷的SVG文件执行JavaScript代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| chatwoot | chatwoot/chatwoot | unspecified ~ 2.6 | - |
|
II. Public POCs for CVE-2021-3741
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-3741
请登录查看更多情报信息。
Same Patch Batch · chatwoot · 2024-11-15 · 3 CVEs total
| CVE-2021-3740 | Session Fixation in chatwoot/chatwoot | |
| CVE-2021-3742 | Server-Side Request Forgery (SSRF) in chatwoot/chatwoot |
IV. Related Vulnerabilities
Same product: chatwoot/chatwoot
-
CVE-2024-0640
Stored XSS in chatwoot/chatwoot -
CVE-2021-3740
Session Fixation in chatwoot/chatwoot -
CVE-2021-3742
Server-Side Request Forgery (SSRF) in chatwoot/chatwoot -
CVE-2023-2109
Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot -
CVE-2022-3741
Improper Restriction of Excessive Authentication Attempts in
Same vendor: chatwoot
-
CVE-2026-72719
Chatwoot: Cross-Account Resource Transfer via `account_id` P -
CVE-2026-63765
Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Uploa -
CVE-2026-44707
Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Acco -
CVE-2026-44706
Chatwoot: SQL Injection in Conversation/Contact Filter API v -
CVE-2024-0640
Stored XSS in chatwoot/chatwoot
Same weakness: CWE-79
-
CVE-2026-102626
LimeSurvey Community Edition 7.4.0 - Stored XSS through the -
CVE-2026-104847
ProseMirror: XSS vulnerability in prosemirror-view's paste h -
CVE-2026-104907
MISP: JavaScript Injection via Remote Tag ID in Event Previe -
CVE-2026-104906
MISP TAXII Object Viewer Stored XSS via Unescaped JSON Outpu -
CVE-2026-104901
MISP ID Translator: Unescaped Remote Event ID Enables Cross-
V. Comments for CVE-2021-3741
No comments yet