Stored XSS in Chat Formatter and Fix POC Analysis

Vulnerability Overview Vulnerability Type: Stored Cross-Site Scripting (XSS) Description: In the chat formatter, regex capture groups are inserted as raw HTML into four templates (inline code, bold, markdown links, and download links). Tool responses reflect user-controlled fields (such as extensions and ring-group descriptions), which can carry an HTML payload. This payload is executed when another administrator views the response in the chat, running within the viewer's session with their associated permissions. Remediation: - Every regex capture group is escaped via before being inserted into the HTML. - Download link URLs are additionally filtered against a scheme whitelist (blocking , , and ). - The CSS-less DOM construction path in the chat console serves as the final defense layer within the formatter. Impact Scope Affected Versions: Versions prior to v1.6.6 Affected Environments: - Single-admin deployments: Not affected - Multi-admin deployments: At risk due to a privilege escalation path from lower-privileged accounts to administrator privileges Known Affected Deployments: None POC Code `` ([ ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); text = text.replace(/ ]+) ([^ /g, function(m, code) { return '' + escapeHtml(code) + ''; }); t

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in Chat Formatter and Fix POC Analysis

More from this source