Medium
chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation
Type: advisorySources: OSV
A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFrameHelper.js of the component Widget. The manipulation of the argument baseUrl leads to origin validation error. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-12245
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 00:03 UTC · Revision 1
Source evidence
chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation
core-osv · Original sourcePublished 27 Oct 2025, 07:32 UTC
A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFrameHelper.js of the component Widget. The manipulation of the argument baseUrl leads to origin validation error. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
osv:CVE-2025-12245
Complete source record
{
"id": "4e1b27a9ea960ce018f9062c47df082f6d8908bed86f199ca354d354efc36a7a",
"url": "https://osv.dev/vulnerability/CVE-2025-12245",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation",
"summary": "A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFrameHelper.js of the component Widget. The manipulation of the argument baseUrl leads to origin validation error. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.",
"evidence": "osv:CVE-2025-12245",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-12245",
"aliases": [
"CVE-2025-12245"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/chatwoot/chatwoot",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "bfa8a8ed6037b11dc631a133866136b07f0059be"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:chatwoot:chatwoot:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.7.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v4.7.0",
"v4.6.0",
"v4.5.2",
"v4.5.1",
"v4.5.0",
"v4.4.0",
"v4.3.0",
"v4.2.0",
"v4.1.0",
"v4.0.4",
"v4.0.3",
"v4.0.2",
"v4.0.1",
"v4.0.0",
"v3.16.0",
"v3.15.0",
"v3.14.1",
"v3.14.0",
"v3.13.0",
"v3.12.0",
"v3.11.1",
"v3.11.0",
"v3.10.2",
"v3.10.1",
"v3.10.0",
"v3.9.0",
"v3.8.0",
"v3.7.0",
"v3.6.0",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.4.0",
"v3.3.1",
"v3.3.0",
"v3.2.0",
"v3.1.1",
"v3.1.0",
"v3.0.0",
"v2.18.0",
"v2.17.1",
"v2.17.0",
"2.16.1",
"v2.16.0",
"v2.15.0",
"v2.14.0",
"v2.13.1",
"v2.13.0",
"v2.12.1",
"v2.12.0",
"v2.11.0",
"v2.10.0",
"v2.9.1",
"v2.9.0",
"v2.8.1",
"v2.8.0",
"v2.7.0",
"v2.6.0",
"v2.5.0",
"v2.4.1",
"v2.4.0",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.1",
"v2.2.0",
"v2.1.1",
"v2.1.0",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v1.22.1",
"v1.22.0",
"v1.21.1",
"v1.21.0",
"v1.20.0",
"v1.19.0",
"v1.18.1",
"v1.18.0",
"v1.17.1",
"v1.17.0",
"v1.16.2",
"v1.16.1",
"v1.15.1",
"v1.15.0",
"v1.14.3",
"v1.14.2",
"v1.14.1",
"v1.14.0",
"v1.13.1",
"v1.13.0",
"v1.12.2",
"v1.12.1",
"v1.12.0",
"v1.11.1",
"v1.11.0",
"v1.10.0",
"v1.9.0",
"v1.8.0",
"v1.7.2",
"v1.7.1",
"v1.7.0",
"v1.6.3",
"v1.6.2",
"v1.6.1",
"v1.6.0",
"v1.5.3",
"v1.5.2",
"v1.5.1",
"v1.5.0",
"v1.4.2",
"1.4.2",
"v1.4.1",
"v1.4.0",
"v1.3.0",
"v1.2.4",
"1.2.4",
"v1.2.3",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.3",
"v1.1.2",
"v1.1.1",
"v1.1.0",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12245.json"
}
}
],
"modified": "2026-10-28T02:30:40.551228001Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12245.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-12245",
"https://vuldb.com/?id.329916",
"https://vuldb.com/?submit.673800",
"https://vuldb.com/?ctiid.329916",
"https://hckwr.com/blog/multiple-vulnerabilities-in-chatwoot/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-345",
"CWE-346"
],
"cna_assigner": "VulDB",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "4.0"
},
{
"last_affected": "4.0"
},
{
"introduced": "4.1"
},
{
"last_affected": "4.1"
},
{
"introduced": "4.2"
},
{
"last_affected": "4.2"
},
{
"introduced": "4.3"
},
{
"last_affected": "4.3"
},
{
"introduced": "4.4"
},
{
"last_affected": "4.4"
},
{
"introduced": "4.5"
},
{
"last_affected": "4.5"
},
{
"introduced": "4.6"
},
{
"last_affected": "4.6"
},
{
"introduced": "4.7.0"
},
{
"last_affected": "4.7.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12245.json"
}
},
"related_cves": [
{
"value": "CVE-2025-12245",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508248,
"published_at": "2025-10-27T07:32:07.544+00:00"
}