chatwoot/chatwoot

vitest 3.0.5

1 advisory. Fixed in 4.1.0.

How it can be abusedIf a developer runs the test suite with the Vitest browser UI enabled on their machine, anyone on that network could use the exposed test server to read arbitrary files or run code on that developer's computer. This affects developers running tests locally, not the deployed Chatwoot application or its users.

• criticalGHSA-5xrq-8626-4rwpWhen Vitest UI server is listening, arbitrary file can be read and executed

axios 1.15.0

11 advisories. Fixed in 1.16.0.

How it can be abusedAn attacker who can influence request configuration could hijack outgoing HTTP requests, steal credentials sent to proxies, tamper with responses, or crash the process with crafted input. In Chatwoot, axios runs mainly in the browser-based Vue frontend talking to its own API over same-origin requests, so an attacker would already need to run code on a user's browser session to exploit this, which limits practical impact.

• highGHSA-35jp-ww65-95whaxios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
• highGHSA-3g43-6gmg-66jwaxios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
• highGHSA-6chq-wfr3-2hj9Axios: Header Injection via Prototype Pollution
• highGHSA-777c-7fjr-54vfAllocation of Resources Without Limits or Throttling in Axios
• highGHSA-hfxv-24rg-xrqfAxios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
• highGHSA-j5f8-grm9-p9fcAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
• highGHSA-p92q-9vqr-4j8vAxios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
• highGHSA-pf86-5x62-jrwfAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
• highGHSA-pjwm-pj3p-43mvaxios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
• highGHSA-pmwg-cvhr-8vh7Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
• highGHSA-q8qp-cvcw-x6jjAxios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

js-cookie 3.0.5

1 advisory. Fixed in 3.0.7.

How it can be abusedThis flaw lets a website's own code be tricked into writing malicious attributes onto every cookie it sets, but only if untrusted user input is used as the cookie name or value in a way that reaches the library's assign function. In Chatwoot, js-cookie is used in the frontend and embeddable widget mostly with fixed names like conversation and user identifiers, so an attacker would need an injection point feeding raw input into those calls; anyone running a self-hosted instance would be exposed mainly through that widget path.

• highGHSA-qjx8-664m-686jJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

vite 6.4.2

1 advisory. Fixed in 8.0.16.

How it can be abusedThis flaw only affects Vite's development server, which lets a developer preview files while coding. An attacker on the same network could trick a Windows developer running the Chatwoot dev server into serving sensitive files from their machine, like environment files with API keys and database passwords.

• highGHSA-fx2h-pf6j-xcffvite: `server.fs.deny` bypass on Windows alternate paths