{"id":"CVE-2026-129158","kind":"vulnerability","aliases":["CVE-2026-129158"],"related":[],"title":"ragent: stored XSS via SVG knowledge-base uploads enables account takeover","description":"ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover.","summary":"ragent 1.1.0 serves uploaded SVG knowledge-base files inline as image/svg+xml, so scripts run in the app origin. Any logged-in user who uploads a crafted SVG can steal the session cookie of a victim who opens it (the reporter demonstrated admin takeover). The upstream issue is open and no fix is published.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ragent","fixed":[],"affected":"1.1.0","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","knowledge-base","ragent","self-hosted","xss"],"not_affected_if":["no-svg-uploads","separate-file-origin"],"how_to_check":"- Check whether you run ragent 1.1.0 (nageoffer/ragent; reporter tested commit c3b6157730).\n- Check whether GET /knowledge-base/docs/{docId}/file returns SVG with Content-Type image/svg+xml and Content-Disposition inline.\n- Check whether any non-admin user can POST to /knowledge-base/{kb-id}/docs/upload with .svg files.\n- Reporter says the login cookie 'Authorization' has no HttpOnly flag, so script can read it.","fix":null,"status":"open","published_at":"2026-11-13T18:17:40+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","triaged_at":"2026-11-13T18:51:52+00:00","updated_at":"2026-11-13T18:52:43+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-13T18:51:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ragent: stored XSS via SVG knowledge-base uploads enables account takeover","impact":"high","summary":"ragent 1.1.0 serves uploaded SVG knowledge-base documents inline as image/svg+xml, so embedded scripts run in the application's origin. An authenticated user who uploads a crafted SVG can take over the accounts of victims who open the document.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["ragent","self-hosted","knowledge-base"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs scripts in victims' sessions and takes over their accounts","analyst_note":"Confirm the fixed version and whether a patch or setting exists; check the vulncheck advisory and the upstream ragent repository.","how_to_check":"- Confirm whether you run ragent 1.1.0 (`unknown` for the exact deployment method; check the version in your deployment or package manifest)\n- Check whether the knowledge-base file endpoint `/knowledge-base/docs/{docId}/file` returns SVG files with `Content-Type: image/svg+xml`\n- Check whether uploads to `/knowledge-base/{kb-id}/docs/upload` accept SVG files from users","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-svg-uploads","separate-file-origin"],"who_is_affected":"Teams that run ragent 1.1.0 with multiple users who can upload knowledge-base documents, and whose users open those documents in the same browser origin as the application. Exposure depends on whether SVG uploads are accepted and served inline. Deployments that do not allow untrusted uploads or that serve files from a separate origin are less exposed; the sources do not say more.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000797,"input_tokens":4624,"output_tokens":670,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch or setting exists; check the vulncheck advisory and the upstream ragent repository.","search":"'-129158':15A,18A '-2026':14A,17A '/docs/upload':129C '/file':136C '/knowledge-base':125C '/knowledge-base/docs':134C '1.1.0':32B,88C 'account':11A,144C 'admin':75B 'ai':21B 'ai-tool':20B 'allow':98C 'app':49B 'applic':141C 'attack':116C 'authent':99C 'base':8A,25B,38B,109C 'bear':122C 'contain':89C 'cooki':65B 'craft':59B 'cross':93C 'cross-sit':92C 'cve':13A,16A 'demonstr':74B 'docid':135C 'document':110C 'enabl':10A,143C 'execut':137C 'file':39B 'fix':84B 'host':29B 'id':128C 'image/svg':42B,114C 'inject':102C 'inlin':40B,112C 'issu':79B 'kb':127C 'kb-id':126C 'knowledg':7A,24B,37B,108C 'knowledge-bas':6A,23B,36B,107C 'log':53B 'logged-in':52B 'open':70B,81B,133C 'origin':50B,142C 'publish':86B 'ragent':1A,19A,26B,31B,87C 'report':73B 'run':46B 'script':45B,95C,103C,121C 'script-bear':120C 'self':28B 'self-host':27B 'serv':33B,111C 'session':64B 'site':94C 'steal':62B 'store':2A,91C 'svg':5A,35B,60B,106C,123C 'takeov':12A,76B,145C 'tool':22B 'upload':9A,34B,57B,105C,118C 'upstream':78B 'user':55B,100C 'via':4A,124C 'victim':68B,132C 'vulner':96C 'xml':43B,115C 'xss':3A,30B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted ragent 1.1.0 deployments where regular (non-admin) users can upload knowledge-base documents and others, including admins, may open the file URL. The reporter showed an admin's login cookie stolen and an admin account created. Skip if you only allow trusted uploaders or serve files from a separate origin.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ragent"],"ptokens":["ragent"],"labels":["aitooling","knowledgebase","medium","ragent","selfhosted","xss"],"campaign_type":null,"search_a":"'-129158':15A,18A '-2026':14A,17A 'account':11A 'base':8A 'cve':13A,16A 'enabl':10A 'knowledg':7A 'knowledge-bas':6A 'ragent':1A,19A 'store':2A 'svg':5A 'takeov':12A 'upload':9A 'via':4A 'xss':3A","search_b":"'1.1.0':32B 'admin':75B 'ai':21B 'ai-tool':20B 'app':49B 'base':25B,38B 'cooki':65B 'craft':59B 'demonstr':74B 'file':39B 'fix':84B 'host':29B 'image/svg':42B 'inlin':40B 'issu':79B 'knowledg':24B,37B 'knowledge-bas':23B,36B 'log':53B 'logged-in':52B 'open':70B,81B 'origin':50B 'publish':86B 'ragent':26B,31B 'report':73B 'run':46B 'script':45B 'self':28B 'self-host':27B 'serv':33B 'session':64B 'steal':62B 'svg':35B,60B 'takeov':76B 'tool':22B 'upload':34B,57B 'upstream':78B 'user':55B 'victim':68B 'xml':43B 'xss':30B","search_c":"'/docs/upload':129C '/file':136C '/knowledge-base':125C '/knowledge-base/docs':134C '1.1.0':88C 'account':144C 'allow':98C 'applic':141C 'attack':116C 'authent':99C 'base':109C 'bear':122C 'contain':89C 'cross':93C 'cross-sit':92C 'docid':135C 'document':110C 'enabl':143C 'execut':137C 'id':128C 'image/svg':114C 'inject':102C 'inlin':112C 'kb':127C 'kb-id':126C 'knowledg':108C 'knowledge-bas':107C 'open':133C 'origin':142C 'ragent':87C 'script':95C,103C,121C 'script-bear':120C 'serv':111C 'site':94C 'store':91C 'svg':106C,123C 'takeov':145C 'upload':105C,118C 'user':100C 'via':124C 'victim':132C 'vulner':96C 'xml':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-129158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129158","severity":null,"published_at":"2026-11-13T18:17:40+00:00","modified_at":"2026-11-13T18:17:40+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","fetched_at":"2026-11-13T18:49:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129158:3916","url":"https://github.com/nageoffer/ragent/issues/187","severity":null,"published_at":"2026-11-13T18:52:43+00:00","modified_at":"2026-11-13T18:52:43+00:00","first_seen_at":"2026-11-13T18:52:43+00:00","fetched_at":"2026-11-13T18:52:43+00:00","note":"Maintainer issue nageoffer/ragent#187 (opened 2026-11-04) still open, no fixed version found; researcher report has PoC (admin cookie theft, Authorization cookie lacks HttpOnly). Not marked verified: no vendor statement on fix.","cites":["https://github.com/nageoffer/ragent/issues/187","https://vul.yulun.ac.cn/20261104/ragent/"]}],"documents":[{"id":148616,"url":"https://www.vulncheck.com/advisories/ragent-1.1.0-stored-xss-via-svg-knowledge-base-document-upload","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":148647,"url":"https://github.com/nageoffer/ragent/issues/187","title":"ragent issue #187: SVG stored XSS (open)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":148649,"url":"https://vul.yulun.ac.cn/20261104/ragent/","title":"Ragent Vulnerability Report (Wu Yulun)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://vul.yulun.ac.cn/20261104/ragent/"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}