{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.5.0"}],"component":"@developer.notchatbot/webchat","cve_ids":["CVE-2026-30048"],"ecosystem":"npm","epss":0.0031,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-w3vx-52j6-9fjp","id":"tcs_01M5KGDQ7NEE2WC0QVCKJZM2H7","modified_at":"2026-03-19T13:11:20.533498Z","published_at":"2026-03-18T18:31:18Z","references":["https://osv.dev/vulnerability/GHSA-w3vx-52j6-9fjp","https://nvd.nist.gov/vuln/detail/CVE-2026-30048","https://app.unpkg.com/@developer.notchatbot/webchat@1.4.4","https://gist.github.com/0xN4no/0601f398942a29259d217ea650f694fe","https://github.com/0xN4no/CVE-2026-30048","https://www.npmjs.com/package/@developer.notchatbot/webchat"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-w3vx-52j6-9fjp","url":"https://osv.dev/vulnerability/GHSA-w3vx-52j6-9fjp"}],"summary":"NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability"}