Medium 5.4Published Jan 19, 2026

CVE-2026-23875CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots.

Updated under an hour ago (2026-10-19 06:25 UTC)

Does this affect you?

It affects crawlchat. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for crawlchat

Exploited in the last 30 days

CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing permission check for the CrawlChat's Discord bot allows non-manage guild users to put malicious content onto the collection knowledge base. Usually, admin / mods of a Discord guild use the `jigsaw` emoji to save a specific message (chain) onto the collection's knowledge base of CrawlChat. Unfortunately an permission check (for e.g. MANAGE_SERVER; MANAGE_MESSAGES etc.) was not done, allowing normal users of the guild to information to the knowledge base. With targeting specific parts that are commonly asked, users can manipulate the content given out by the bot (on all integrations), to e.g. redirect users to a malicious site, or send information to a malicious user. Version 0.0.8 patches the issue.

CVSS: 5.4 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Jun 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

crawlchat crawlchat crawlchat:crawlchat	before 0.0.8	NVD

References

https://github.com/crawlchat/crawlchat/commit/f90ebb93c6a830f6cf609d683f6425af8434573apatch
https://github.com/crawlchat/crawlchat/releases/tag/v0.0.8product, release-notes
https://github.com/crawlchat/crawlchat/security/advisories/GHSA-f484-62p4-6w4pexploit, vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.