Read the docs
TI-2026-79410 Aliases CVE-2026-97635GHSA-mw3v-p424-652w

Cross-site scripting in Agent Zero Web UI chat and uploads

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads, which is an improper neutralization of input during web page generation (CWE-79). An unauthenticated remote attacker can get a victim to view crafted content, and when Agent Zero reproduces that content in the chat interface, injected JavaScript runs in the victim's authenticated Web UI session. User interaction is required.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Fixed Agent Zero (Agent Zero): 1.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Agent ZeroAgent Zerobefore 1.151.15Patch availableCNA
  • Agent Zero VendorAgent Zero Affected before 1.15 Fixed in 1.15 Patch available CNA

Remediation

Update Agent Zero to version 1.15 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Agent Zero (Agent Zero) Fixed in 1.15

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-97635
  2. 2026-10-22 Alias added: GHSA-mw3v-p424-652w
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-11-06 CISA SSVC decision points changed

References

Advisory 1

Other 3

  • TI-2025-35030 Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors. CVSS 3.1HIGH 7.3
  • TI-2025-35029 An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows… CVSS 3.1LOW 3.5
  • TI-2026-23587 Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP… CVSS 3.1HIGH 8.6
  • TI-2025-03118 frdel Agent-Zero get_work_dir_files path traversal CVSS 4.0MEDIUM 5.3
  • TI-2025-05576 frdel Agent-Zero image_get.py image_get path traversal CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences