Read the docs
TI-2026-76785 Aliases CVE-2026-14933GHSA-9p8h-2662-3xvr

Cross-site scripting in Unblu Spark embedded co-browsing

Priority MEDIUM 40CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, contains cross-site scripting in the embedded co-browsing feature. The flaw occurs because the agent's browser renders co-browsed page content as HTML, which is a missing neutralization of input during web page generation (CWE-79). An unauthenticated remote attacker in the visitor role can run arbitrary JavaScript in the browser of an agent who joins the attacker's co-browsing session, under that agent's identity in the Agent Desk or Single Conversation Desk. Mobile co-apping is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk. Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0056 46th percentileScored 2026-11-07
Fix Fixed Unblu Spark (Unblu inc.): 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Unblu inc.Unblu Spark7.0 – 7.57.7; 8.0 – 8.39.28.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0, 8.39.3Patch availableCNA
  • Unblu Spark VendorUnblu inc. Affected 7.0 – 7.57.7; 8.0 – 8.39.2 Fixed in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0, 8.39.3 Patch available CNA

Remediation

Upgrade Unblu Spark to 8.39.3, 8.38.2-hotfix.0, 8.37.2-hotfix.2, or 8.35.2-hotfix.0, which are the fixed versions listed for their respective branches. The sources list no vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Unblu Spark (Unblu inc.) Fixed in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0, 8.39.3

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-14933
  2. 2026-10-20 Alias added: GHSA-9p8h-2662-3xvr
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: MEDIUM → LOW
  5. 2026-10-22 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2026-76784 Missing authorization in Unblu Spark configuration cascade operations CVSS 4.0CRITICAL 9.3
  • TI-2026-07180 Unblu Spark Open Redirect leading to DOM-Based XSS CVSS 4.0CRITICAL 9.3
  • TI-2025-03091 Replace uploaded files knowing the file upload ID CVSS 4.0HIGH 7.0
  • TI-2025-03090 File upload functionality possible even when disabled CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences