CVE-2026-28509 PUBLISHED

LangBot has a Cross Site Scripting(XSS) Vulnerability

Assigner: GitHub_M
Reserved: 27.02.2026 Published: 06.03.2026 Updated: 06.03.2026

LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting (XSS) vulnerability. This issue has been patched in version 4.8.7.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS Score: 6.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	langbot-app
Product	LangBot
Versions	Version < 4.8.7 is affected

References

https://github.com/langbot-app/LangBot/security/advisories/GHSA-w8gq-g4pc-xh3h
https://github.com/langbot-app/LangBot/commit/614621ab7b84fe50da3c6137705cde5a99429866

Problem Types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE