simplechat vulnerabilities

3 known vulnerabilities in simplechat from Microsoft. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  simplechat: Improper Neutralization of Input During Web Page Generation

  CVE-2026-105798Oct 6, 2026Microsoft

  SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that group_workspaces.html late

• 8.8 High severity

  simplechat: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-105797Oct 6, 2026Microsoft

  SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user

• 8.6 High severity

  simplechat: Missing Authentication for Critical Functionality

  CVE-2026-57206Jul 16, 2026Microsoft

  SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/single_app/plugin_validation_endpoint.py, including `POST /api/admin/p