SimpleChat: Stored cross-site scripting via group document filename
Summary
SimpleChat, an AI chat application with group workspaces, does not safely render group document filenames in the Share action of the group workspace. An authenticated group Owner, Admin or DocumentManager can upload a document with a crafted filename. When another group member clicks Share on that document, the injected script runs in the SimpleChat origin with the victim's session, so it can access data and perform actions the victim is allowed to use. The CNA rates the CVSS 3.1 base score at 8.7 (High), and NVD analysis is still pending.
Affected
- Microsoft SimpleChat before 0.261.029 (CNA range: < 0.261.029)
Fixed in
- Fixed in SimpleChat 0.261.029 (fix commit 537a259eb048b8f6d1c94193fa0c9683ab0bace9)
- Later releases such as v0.261.061 also contain the hardening
Workaround
- No vendor workaround documented. Upgrading is the fix.
- Interim measure (not from the vendor): restrict the Owner, Admin and DocumentManager roles in group workspaces to trusted staff until the update is applied.
- Interim measure (not from the vendor): review existing group document filenames for quotes or script content, and do not click Share on unfamiliar documents.
Exploitation
- CISA SSVC lists exploitation as 'poc' and automatable as 'no'.
- The advisory describes the attack steps in detail, but no confirmed exploitation in the wild is known.
- The CISA-ADP container tags the advisory reference as 'exploit'; this tag does not confirm active exploitation.
Our recommendation
- Update SimpleChat to 0.261.029 or later, and verify the deployed version.
- Until then, limit group roles that can upload documents to trusted users.
- Check existing group documents for suspicious filenames and monitor for unusual activity after Share actions.
- Prioritise this update for multi-user group workspaces, where the risk is highest.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qwcw-r653-j8c6 github.com
- Fix commit 537a259 (GitHub) github.com
- Pull request 1500 (GitHub) github.com
- Release v0.261.061 (GitHub) github.com
- OSV record CVE-2026-105798 osv.dev
- Vulners CVE-2026-105798 vulners.com
- HOL Guard CVE-2026-105798 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:32.
Original description (NVD)
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that group_workspaces.html later interpolates into inline Share event handlers. The escapeGroupHtml function leaves apostrophes unchanged, while escapeHtml produces an HTML entity that the browser decodes before JavaScript evaluation, so either path permits the filename to terminate the handler string. An authenticated group Owner, Admin, or DocumentManager can persist script that executes in the SimpleChat origin when another group member clicks Share, allowing access to victim-visible data and actions with the victim session. This issue is fixed in version 0.261.029.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.