CVE-2023-49785: Critical SSRF and XSS in NextChat

CVE-2023-49785 is a critical severity (CVSS 9.1) server side request forgery and cross-site scripting flaw in NextChat, also called ChatGPT-Next-Web, version 2.11.2 and earlier. No patch existed at disclosure. Do not expose the app to the internet, and check the project for later fixes.

What's affected

The record says versions 2.11.2 and prior are vulnerable. The weaknesses are CWE-918 (server side request forgery) and CWE-79 (cross-site scripting). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

The record says the flaw gives read access to internal HTTP endpoints and write access using POST, PUT and other methods, and that attackers can use open instances as proxies to hide their source address. Horizon3.ai, which reported the issue, says the vulnerable code arrived in September 2023 and that most online instances are likely affected.

Fixed versions: none were available when the CVE was published on 2024-03-12, and Horizon3 recorded no vendor response after its early reports. The record references a GitHub issue and a pull request. I could not confirm a fixed release, so check the project's releases before relying on a newer version.

How to check if you're exposed

Find where NextChat runs in your organization, including personal deployments on cloud accounts. Check the version in the app or the container tag.

docker ps --format "{{.Image}}" | grep -i -E "nextchat|chatgpt-next-web"

Then ask whether the instance is reachable from the internet and whether it can reach internal services. An instance with both properties is the risky case. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.

What to do now

1. Inventory NextChat and ChatGPT-Next-Web deployments.
2. Take any internet exposed instance offline, or place it behind authentication at the network edge.
3. If it must stay up, run it on an isolated network with no route to internal resources, as the record advises.
4. Check the project repository for a fixed release and upgrade when one is confirmed.
5. Review outbound and internal request logs from the host for unexpected targets.
6. Rotate API keys that were configured in affected instances.

Why it matters

Server side request forgery turns a server into a proxy. The attacker asks it to fetch addresses the attacker cannot reach directly, such as internal services and cloud metadata endpoints. Allowing write methods raises the impact from reading data to changing it.

Chat front ends for language models are often deployed fast and left open. They hold API keys and sit on networks with other services, which makes SSRF more serious than it looks. This CVE is not on the CISA KEV list.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Horizon3.ai write-up
• Project repository
• Gold record

Last reviewed: 19 October 2026.