# Stored XSS attack: Link preview in channel messages

**URL:** <https://community.sendbird.com/t/stored-xss-attack-link-preview-in-channel-messages/9059>\
**Category:** Sendbird Chat UIKit\
**Created:** [February 14, 2024, 7:38pm UTC](https://community.sendbird.com/t/stored-xss-attack-link-preview-in-channel-messages/9059 "2024-02-14T19:38:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dhorak\_instawork](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/dhorak_instawork/32/4951_2.png) [@dhorak\_instawork](https://community.sendbird.com/u/dhorak_instawork)\
**Post date:** [February 14, 2024, 7:38pm UTC](https://community.sendbird.com/t/stored-xss-attack-link-preview-in-channel-messages/9059/1 "2024-02-14T19:38:30Z")

</div>

**[Problem/Question]**  
There is a vulnerability that exists on the “hyperlink card” (preview of the link posted into a channel) when you send a link to someone’s else in a conversation.

An attacker can manipulate the value of the “og:url” meta tag with a JavaScript payload, e.g. `javascript:alert()`, which result in the XSS being clicklable on victim’s side.

A PoC can be found in the **Reproduction Steps** section

Is there any way how put in place **Content Security Policy** and/or to set **Content-Type** and **X-Content-Type-Options** headers to ensure that browsers interpret the responses in without this vulnerability?.

* * *

**[UIKit Version]**  
@sendbird/chat: 4.10.4  
@sendbird/uikit-react: 3.9.0

**[Reproduction Steps]**

- Open the sample app, [https://stackblitz.com/edit/sendbird-react-uikit-base-app?file=src%2FApp.jsx](https://stackblitz.com/edit/sendbird-react-uikit-base-app?file=src%2FApp.jsx)
- Send [https://testdiog10.000webhostapp.com/t.html](https://testdiog10.000webhostapp.com/t.html) into any chat
- Click on the link when preview rendered
- JS alert is executed to showcase the Stored XSS vulenerability.

**[Frequency]**  
All the time

**[Current impact]**  
It has been report a high severity potential Stored XSS attack by a security advisor.

---

<div class="post-metadata">

**Author:** ![Miyoung\_Han](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/miyoung_han/32/183_2.png) [@Miyoung\_Han](https://community.sendbird.com/u/Miyoung_Han)\
**Post date:** [March 25, 2024, 6:45pm UTC](https://community.sendbird.com/t/stored-xss-attack-link-preview-in-channel-messages/9059/2 "2024-03-25T18:45:01Z")

</div>

We released the fix in v3.9.3

> <https://github.com/sendbird/sendbird-uikit-react/blob/main/CHANGELOG.md#v393-jan-5-2024>