The vulnerability is a stored cross‑site scripting flaw in ChatterMate.chat that allows an attacker to inject and execute malicious HTML and JavaScript payloads through chatbot input. The flaw specifically processes <iframe> tags containing javascript: URIs, which are executed in the victim’s browser. As the payload runs with the page’s privileges, an attacker can read client‑side storage such as localStorage and cookies, potentially exposing authentication tokens or personal data. The weakness is a typical input validation issue classified as CWE‑79.

Users of the ChatterMate.chat framework running version 1.0.8 or older are affected. The flaw exists in the open‑source implementation hosted on GitHub, and version 1.0.9 and later contain the fix.

With a CVSS score of 9.3 the vulnerability is considered high‑severity. The EPSS probability is less than 1 %, indicating a low likelihood of exploitation at present, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a user who can send arbitrary chat input to a deployed instance of the framework; if that instance is publicly reachable, any visitor could target the browser session. Once exploited, the attacker gains client‑side execution, enabling theft of tokens, cookies, and other sensitive data stored locally.