{"id":"CVE-2026-97635","kind":"vulnerability","aliases":["CVE-2026-97635"],"related":[],"title":"Agent Zero Web UI: injected scripts run in victims' chat sessions","description":"The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.","summary":"Agent Zero Web UI before 1.15 does not sanitize chat messages or file uploads. Injected JavaScript runs in the authenticated session of any user who views the content (user interaction required), letting an attacker act as that user in the agent. No workaround stated.","severity":"high","cvss":8.6,"epss":0.0026,"exploited":false,"exploited_at":null,"products":[{"name":"Agent Zero","fixed":["1.15"],"affected":"< 1.15","ecosystem":"other"}],"ecosystems":["other"],"tags":["agent-zero","ai-tooling","self-hosted","web-ui","xss"],"not_affected_if":["already-on-1.15-or-later","ui-not-reachable-by-untrusted-users","version-1.15-or-later"],"how_to_check":"Check the Agent Zero version (UI or the git tag/Docker image you run). Any version below 1.15 is affected. Exposed if the UI is reachable by anyone who can send chat messages or upload files.","fix":"Upgrade Agent Zero to 1.15 or later. Until then, do not expose the web UI to untrusted users or networks.","status":"open","published_at":"2026-10-22T18:17:32+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:39:17+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-23T22:39:17Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Agent Zero Web UI to 1.15 or later.","reach":"network","title":"Agent Zero Web UI: injected scripts run in victims' chat sessions","impact":"high","summary":"Agent Zero's web UI does not sanitize chat messages or file uploads before displaying them. Injected JavaScript runs in the logged-in session of anyone who views the content, so an attacker can act as that user in the agent.","category":"ai-tooling","who_cares":["agent-zero","self-hosted","web-ui"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs script in victim's session and controls the agent","analyst_note":"Check the NVD entry and Agent Zero release notes to confirm whether a victim must open the chat and what the minimum fixed version is.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["already-on-1.15-or-later"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000472,"input_tokens":2911,"output_tokens":362,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Agent Zero release notes to confirm whether a victim must open the chat and what the minimum fixed version is.","search":"'-2026':13A,16A '-97635':14A,17A '1.15':38B,83C 'act':67B 'agent':1A,18A,21B,33B,73B,78C,99C,120C 'agent-zero':20B 'ai':24B 'ai-tool':23B 'attack':66B 'authent':52B,119C 'chat':10A,42B,93C,105C 'content':60B,102C 'context':114C 'correct':86C 'cve':12A,15A 'execut':111C 'file':45B,96C 'host':28B 'inject':5A,47B,108C 'input':91C 'interact':62B 'interfac':106C 'javascript':48B,109C 'let':64B 'messag':43B,94C 'provid':90C 'reproduc':101C 'requir':63B 'run':7A,49B 'sanit':41B,87C 'script':6A 'self':27B 'self-host':26B 'session':11A,53B,124C 'state':76B 'tool':25B 'ui':4A,31B,36B,81C,123C 'upload':46B,97C 'user':56B,61B,70B,89C 'user-provid':88C 'victim':9A,117C 'view':58B 'web':3A,30B,35B,80C,122C 'web-ui':29B 'workaround':75B 'xss':32B 'zero':2A,19A,22B,34B,79C,100C,121C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T18:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97635","severity":null,"published_at":"2026-10-22T18:17:32+00:00","modified_at":"2026-10-23T17:17:17+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97635:279","url":null,"severity":null,"published_at":"2026-10-23T22:41:58+00:00","modified_at":"2026-10-23T22:41:58+00:00","first_seen_at":"2026-10-23T22:41:58+00:00","fetched_at":"2026-10-23T22:41:58+00:00","note":"CVE record via CISA CSAF/Rapid7: affected < 1.15, fixed 1.15; CVSS 3.1 8.1 UI:R (victim must view the content), no auth needed to inject, not in KEV, no public PoC found. Did not reach the vendor release notes; issue #943 is a related earlier XSS report (not confirmed to be this CVE). Sibling CVE-2026-47119 (SVG image_get XSS) also fixed in 1.15."},{"source":"epss","external_id":"CVE-2026-97635","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97635","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1563,"url":"https://www.sechot.net/advisories/cisa/VA-26-296-01","title":"VA-26-296-01: AgentZero XSS (CISA CSAF)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1564,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-97635/","title":"Rapid7 CVE-2026-97635","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1565,"url":"https://github.com/agent0ai/agent-zero/issues/943","title":"XSS in Agent0ai Dashboard/UI (unescaped user content)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}