RAGENT · CVE-2026-129158 · AI agents & MCP
NO FIX YET
ragent 1.1.0 serves uploaded SVG knowledge-base files inline as image/svg+xml, so scripts run in the app origin. Any logged-in user who uploads a crafted SVG can steal the session cookie of a victim who opens it (the reporter demonstrated admin takeover). The upstream issue is open and no fix is published.
first public Nov 13, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted ragent 1.1.0 deployments where regular (non-admin) users can upload knowledge-base documents and others, including admins, may open the file URL. The reporter showed an admin's login cookie stolen and an admin account created. Skip if you only allow trusted uploaders or serve files from a separate origin.
Not affected if no-svg-uploads, separate-file-origin
Who cares knowledge-base, ragent, self-hosted, xss
No fix yet, per the sources.
ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.