GHSA-8c6x-g4fw-8rf4
Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats.
Impact
A Cross-Site Scripting (XSS) vulnerability was found in the HTML output of chats. XSS is intended to be mitigated by Jinja's escape function. However, autoescape=True was missing when setting the environment. Although the actual impact is low, considering the HTML file is being viewed offline, an adversary may still be able to inject malicious payloads into the chat through WhatsApp. All users are affected.
Patches
The vulnerability is patched in 0.9.5. All users are strongly advised to update the exporter to the latest version.
Workarounds
No workaround is available. Please update the exporter to the latest version.
References
https://github.com/KnugiHK/WhatsApp-Chat-Exporter/commit/bfdc68cd6ad53ceecf132773f9aaba50dd80fe79 https://owasp.org/www-community/attacks/xss/
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats.
Impact
A Cross-Site Scripting (XSS) vulnerability was found in the HTML output of chats. XSS is intended to be mitigated by Jinja's escape function. However, autoescape=True was missing when setting the environment. Although the actual impact is low, considering the HTML file is being viewed offline, an adversary may still be able to inject malicious payloads into the chat through WhatsApp. All users are affected.
Patches
The vulnerability is patched in 0.9.5. All users are strongly advised to update the exporter to the latest version.
Workarounds
No workaround is available. Please update the exporter to the latest version.
References
https://github.com/KnugiHK/WhatsApp-Chat-Exporter/commit/bfdc68cd6ad53ceecf132773f9aaba50dd80fe79 https://owasp.org/www-community/attacks/xss/
- Record
GHSA-8c6x-g4fw-8rf4- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats.
Impact
A Cross-Site Scripting (XSS) vulnerability was found in the HTML output of chats. XSS is intended to be mitigated by Jinja's escape function. However, autoescape=True was missing when setting the environment. Although the actual impact is low, considering the HTML file is being viewed offline, an adversary may still be able to inject malicious payloads into the chat through WhatsApp. All users are affected.
Patches
The vulnerability is patched in 0.9.5. All users are strongly advised to update the exporter to the latest version.
Workarounds
No workaround is available. Please update the exporter to the latest version.
References
https://github.com/KnugiHK/WhatsApp-Chat-Exporter/commit/bfdc68cd6ad53ceecf132773f9aaba50dd80fe79 https://owasp.org/www-community/attacks/xss/
- Record
GHSA-8c6x-g4fw-8rf4- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
whatsapp-chat-exporterPyPI | before 0.9.5 | 0.9.5 |
whatsapp-chat-exporterPyPI | before 0.9.5, plus listed versions 0.60.7.00.8.00.8.10.8.20.8.50.9.00.9.1 | 0.9.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-8c6x-g4fw-8rf4 is a medium vulnerability (CVSS 5.4) in whatsapp-chat-exporter, published July 10, 2023. No source lists public exploit code. Fixed in whatsapp-chat-exporter 0.9.5.