AIKIDO-2026-10360
@cometchat/chat-uikit-react is vulnerable to Cross-site Scripting (XSS)
71
High Risk
This Affects:
@cometchat/chat-uikit-reactTL;DR
Affected versions of this package are affected by a cross-site scripting (XSS) vulnerability in the CometChat React UI Kit. Insufficient sanitization of user-controlled message or UI content allows crafted input to be rendered as HTML in the application interface. An attacker able to send specially crafted content through the chat system could inject malicious script code that executes in the browser of users viewing the message or affected component. This could allow session manipulation or other client-side attacks.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@cometchat/chat-uikit-react is vulnerable to Cross-site Scripting (XSS) in versions 5.0.0 - 6.3.12.
How to fix this
Upgrade the @cometchat/chat-uikit-react library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant