CVE-2026-28509

MEDIUM 5.4CVE-2026-28509 · Published 06/03/2026 · updated 17/06/2026

In short

CVE-2026-28509 is a MEDIUM (CVSS 5.4) vulnerability affecting langbot (langbot).
Chance of exploitation in the next 30 days (EPSS): 0.22%, higher than 13.0% of all vulnerabilities.
Fix: update to 4.8.7 or later.

Package	Affected versions	Patched versions
langbot langbot	`< 4.8.7`	`4.8.7`

Description

LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting (XSS) vulnerability. This issue has been patched in version 4.8.7.

References

langbot-app/LangBot commit 614621a · Patch
langbot-app/LangBot security advisory · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free