CVE-2026-97635

Agent Zero Web UI XSS

State: Published
Severity: 8.6 High
Published: Oct 22, 2026
Updated: Oct 22, 2026
Reserved: Sep 24, 2026

Description

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	cisa-cg
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	cisa-cg

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Agent ZeroAgent Zero	before 1.15Affected 1.15Not affected

References

urlrelease-notes
urlissue-tracking
urlvdb-entry
urlthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.