Read the docs
TI-2026-70704 Aliases CVE-2026-108725GHSA-37wv-8fg5-p97x

Stored cross-site scripting in Cheshire Cat AI core uploads plugin

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting flaw in its uploads plugin (CWE-79). The plugin accepts uploaded HTML files without type restrictions, so an authenticated user can store script that runs when a signed-in victim opens the public file URL. The script runs in the application origin with the victim's access_token cookie, including administrators.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/{path} URL to a signed-in victim, executing script in the application origin with the victim's access_token cookie, including administrators.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cheshire-cat-aicoreup to 2.0.23—No fix listedCNA
  • core Vendorcheshire-cat-ai Affected up to 2.0.23 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Cheshire Cat AI core.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-108725
  2. 2026-10-11 Alias added: GHSA-37wv-8fg5-p97x
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 2

  • TI-2026-61593 cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication CVSS 4.0MEDIUM 6.9
  • TI-2026-58452 Cheshire Cat AI Memory Collection Endpoint Information Disclosure CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences