CVE-2023-7215: XSS in chatgpt-web 2.11.1

Successful exploitation of CVE-2023-7215 allows an attacker to inject arbitrary JavaScript code into the chatgpt-web application. This can lead to a variety of malicious actions, including session hijacking, stealing sensitive user data (such as API keys or authentication tokens), and defacing the application. The attacker could potentially redirect users to phishing sites or install malware. The impact is primarily limited to the user's browser session, but the consequences can be severe depending on the sensitivity of the data accessed within that session.

1. Reserved2024-01-05
2. Published2024-01-08
3. Modified2025-06-03
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-7215 is to upgrade to version 2.11.2 of chatgpt-web, which contains the fix for this vulnerability. If upgrading immediately is not possible, consider implementing input validation and sanitization on the Description parameter to prevent the injection of malicious code. While not a complete solution, this can reduce the attack surface. Review and update any existing web application firewalls (WAFs) to block requests containing suspicious JavaScript payloads in the Description parameter. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the Description parameter and verifying that it does not execute.