CVE-2026-28509: falha de média gravidade em langbot-app LangBot
LangBot has a Cross Site Scripting(XSS) Vulnerability
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.2%
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting (XSS) vulnerability. This issue has been patched in version 4.8.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Produtos afetados
langbot-app · LangBotCVEs relacionadas — langbot-app LangBot
No mesmo produto, das mais perigosas para as menos.
CVE-2026-90562CRITICALLangBot before 4.10.11 Authentication Bypass via Weak Recovery KeyEPSS 0.7%CVE-2026-54449HIGHLangBot: Authenticated RCE Via MCP ConfigurationEPSS 0.7%CVE-2026-90938HIGHLangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocketEPSS 0.6%CVE-2025-59835HIGHLangBot has a cross-directory file upload vulnerability, which could lead to system takeoverEPSS 0.4%CVE-2026-112265HIGHLangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity VerificationEPSS 0.2%