@nitra/auth-components (>=1.2.0, <=3.8.7), @nitra/vite-boot (>=1.0.0, <=2.2.0) +1 more potentially affected by CVE-2026-118256 via petite-vue-i18n (>=9.14.5, <=10.0.8)

petite-vue-i18n NPM version =9.14.5, =1.2.0, =1.0.0, =2.2.0 - gptx-chatbot-ui 1.2.0 Source cves: CVE-2026-118256 Source advisory: OSV:GHSA-8RC2-428Q-7WW3...

@nitra/auth-components (>=1.2.0, <=3.8.7), @nitra/vite-boot (>=1.0.0, <=2.2.0) +1 more potentially affected by CVE-2025-53892 +1 more via petite-vue-i18n (>=9.14.5, <=10.0.8)

petite-vue-i18n NPM version =9.14.5, =1.2.0, =1.0.0, =2.2.0 - gptx-chatbot-ui 1.2.0 Source cves: CVE-2025-53892, CVE-2026-118256 Source advisory: GHSA-8RC2-428Q-7WW3...

gptx-chatbot-ui (1.2.0) potentially affected by CVE-2025-53892 +1 more via petite-vue-i18n (10.0.8)

petite-vue-i18n NPM version 10.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on petite-vue-i18n and may be impacted: - gptx-chatbot-ui 1.2.0 Source cves: CVE-2025-53892, CVE-2026-118257 Source advisory: GHSA-83RM-6C8R-G728...

gptx-chatbot-ui (1.2.0) potentially affected by CVE-2026-118257 via petite-vue-i18n (10.0.8)

petite-vue-i18n NPM version 10.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on petite-vue-i18n and may be impacted: - gptx-chatbot-ui 1.2.0 Source cves: CVE-2026-118257 Source advisory: OSV:GHSA-83RM-6C8R-G728...

CVE-2026-85693

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-85693

Chatbot UI (open-source chat application) contains an authorization bypass in its retrieval endpoint (/api/retrieval/retrieve). The root cause is a service-role Supabase client that bypasses row-level security and fails to validate file ownership, allowing any authenticated user to retrieve index...

CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-85693

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

EUVD-2026-71142

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-85693: Authorization Bypass Through User-Controlled Key

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

PT-2026-85579

Name of the Vulnerable Software and Affected Versions Chatbot UI affected versions not specified Description An authorization bypass exists in the retrieval endpoint. Authenticated attackers can access private file content of other users by providing arbitrary file UUIDs. The issue occurs because...

Malware in @servicetitan/titan-chatbot-ui

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @servicetitan/titan-chatbot-ui (npm)

npm/@servicetitan/titan-chatbot-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11941 Malicious code in @servicetitan/titan-chatbot-ui (npm)

npm/@servicetitan/titan-chatbot-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malware in @servicetitan/titan-chatbot-ui-anvil2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @servicetitan/titan-chatbot-ui-cypress

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Chatbot UI Panel - Detect

Chatbot UI is an open-source AI chat app !/usr/bin/env python3 -- coding: utf-8 -- """Chatbot UI is an open-source AI chat app.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Chatbot UI Panel - Detect', 'description...