Microsoft SimpleChat up to 0.261.028 Escape Logic group_workspaces.html escapeGroupHtml cross site scripting

Summaryinfo

A vulnerability was found in Microsoft SimpleChat up to 0.261.028 and classified as problematic. This affects the function escapeGroupHtml of the file group_workspaces.html of the component Escape Logic. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-105798. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Microsoft SimpleChat up to 0.261.028. Affected is the function escapeGroupHtml of the file group_workspaces.html of the component Escape Logic. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that group_workspaces.html later interpolates into inline Share event handlers. The escapeGroupHtml function leaves apostrophes unchanged, while escapeHtml produces an HTML entity that the browser decodes before JavaScript evaluation, so either path permits the filename to terminate the handler string. An authenticated group Owner, Admin, or DocumentManager can persist script that executes in the SimpleChat origin when another group member clicks Share, allowing access to victim-visible data and actions with the victim session. This issue is fixed in version 0.261.029.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-105798 since 10/05/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/06/2026). This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

By approaching the search of inurl:group_workspaces.html it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.261.029 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Chat Software

Vendor

• Microsoft

Name

• SimpleChat

Version

• 0.261.028

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://github.com/microsoft/simplechat/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion