CVE-2026-105798

Name of the Vulnerable Software and Affected Versions SimpleChat versions prior to 0.261.029

Description An issue exists where the application stores a filename provided by a user during a request to the 'POST /api/group documents/upload' endpoint. This filename is later interpolated into inline Share event handlers within group workspaces.html. Because the escapeGroupHtml() function does not change apostrophes and the escapeHtml() function produces entities that the browser decodes before JavaScript evaluation, an attacker can terminate the handler string to inject scripts. An authenticated user with Owner, Admin, or DocumentManager privileges can persist a script that executes in the application origin when another group member clicks Share, enabling access to data and actions associated with the victim session.

Recommendations Update to version 0.261.029.