How do I check whether I am affected by CVE-2026-97635?

Check the Agent Zero version (UI or the git tag/Docker image you run). Any version below 1.15 is affected. Exposed if the UI is reachable by anyone who can send chat messages or upload files.

What is the fix for CVE-2026-97635?

Upgrade Agent Zero to 1.15 or later. Until then, do not expose the web UI to untrusted users or networks.

Who is not affected by CVE-2026-97635?

Not affected if: already-on-1.15-or-later, ui-not-reachable-by-untrusted-users, version-1.15-or-later.

Live › vulnerability › CVE-2026-97635

Go to dashboard

high8.6AI agents & MCPother

Agent Zero Web UI: injected scripts run in victims' chat sessions

Agent Zero Web UI before 1.15 does not sanitize chat messages or file uploads. Injected JavaScript runs in the authenticated session of any user who views the content (user interaction required), letting an attacker act as that user in the agent. No workaround stated.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.6

high

scored by 9119a7d8-5eab-497f-8521-727c672e3725

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker runs script in victim's session and controls the agent.
CVSS said: 8.6. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-97635

Go to dashboard

high8.6AI agents & MCPother

Agent Zero Web UI: injected scripts run in victims' chat sessions

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.6

high

scored by 9119a7d8-5eab-497f-8521-727c672e3725

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker runs script in victim's session and controls the agent.
CVSS said: 8.6. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Agent Zero Web UI: injected scripts run in victims' chat sessions

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Agent Zero Web UI: injected scripts run in victims' chat sessions

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources