---
id: "CVE-2026-97635"
kind: "vulnerability"
aliases: ["CVE-2026-97635"]
title: "Agent Zero Web UI: injected scripts run in victims' chat sessions"
severity: "high"
cvss: 8.6
epss: 0.0026
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Agent Zero", "fixed": ["1.15"], "affected": "< 1.15", "ecosystem": "other"}]
ecosystems: ["other"]
tags: ["agent-zero", "ai-tooling", "self-hosted", "web-ui", "xss"]
not_affected_if: ["already-on-1.15-or-later", "ui-not-reachable-by-untrusted-users", "version-1.15-or-later"]
published_at: "2026-10-22T18:17:32+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97635", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:41:58+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-97635", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Agent Zero Web UI: injected scripts run in victims' chat sessions

Agent Zero Web UI before 1.15 does not sanitize chat messages or file uploads. Injected JavaScript runs in the authenticated session of any user who views the content (user interaction required), letting an attacker act as that user in the agent. No workaround stated.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:Agent Zero affected < 1.15 fixed 1.15

## How to check

Check the Agent Zero version (UI or the git tag/Docker image you run). Any version below 1.15 is affected. Exposed if the UI is reachable by anyone who can send chat messages or upload files.

## Fix

Upgrade Agent Zero to 1.15 or later. Until then, do not expose the web UI to untrusted users or networks.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97635
- 2026-10-23T22:41:58+00:00 analyst — CVE record via CISA CSAF/Rapid7: affected < 1.15, fixed 1.15; CVSS 3.1 8.1 UI:R (victim must view the content), no auth needed to inject, not in KEV, no public PoC found. Did not reach the vendor release notes; issue #943 is a related earlier XSS report (not confirmed to be this CVE). Sibling CVE-2026-47119 (SVG image_get XSS) also fixed in 1.15.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-97635

## Documents

- [advisory] VA-26-296-01: AgentZero XSS (CISA CSAF) https://www.sechot.net/advisories/cisa/VA-26-296-01
- [describes] Rapid7 CVE-2026-97635 https://www.rapid7.com/db/vulnerabilities/cve-2026-97635/
- [mentions] XSS in Agent0ai Dashboard/UI (unescaped user content) https://github.com/agent0ai/agent-zero/issues/943

## From the sources

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_