Unblu Spark: Cross-site scripting in embedded co-browsing
Summary
Unblu Spark, on-premises and cloud, contains a cross-site scripting flaw in the embedded co-browsing feature. A remote attacker in the visitor role can inject HTML content that the agent's browser renders, so JavaScript runs in the agent's session in the Agent Desk or Single Conversation Desk. Exploitation requires an agent to join a co-browsing session started by the attacker; mobile co-apping is not affected.
Affected
- Unblu Spark 7.0 through 7.57.7
- Unblu Spark 8.0 through 8.39.2 (except fixed hotfix lines listed below)
- On-premises and cloud deployments per CVE record; Unblu Cloud is already fixed
Fixed in
- Unblu Spark 8.39.3 or later (per CNA record)
- Unblu Spark 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these lines
- Unblu Spark 7.57.9 or later (reported only by a secondary source, to be verified with the vendor)
- Unblu Cloud: fix already deployed
Workaround
- On-premises, if an upgrade is not immediately possible: disable embedded co-browsing by setting com.unblu.messenger.embeddedCoBrowsingEnabled to false (per vendor bulletin as quoted in the research notes; confirm against UBL-2026-004)
- Unblu Cloud customers need no action
Exploitation
- Not listed in CISA KEV; no known active exploitation
- No public proof-of-concept confirmed
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Check whether any on-premises Unblu Spark instance is in use and which build it runs
- Obtain bulletin UBL-2026-004 from the vendor and confirm fixed builds
- Upgrade on-premises instances to a fixed build; apply the workaround if upgrade is delayed
- Plan the CVE-2026-9589 fix (critical authorization bypass) in the same window
- Monitor KEV and vendor updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Unblu security bulletin UBL-2026-004 docs.unblu.com
- CNA record via Vulners vulners.com
- VulDB entry 422774 vuldb.com
- OpenCVE CVE-2026-14933 app.opencve.io
- HOL Guard CVE-2026-14933 hol.org
- Strix CVE-2026-14933 www.strix.ai
- TheHackerWire CVE-2026-14933 www.thehackerwire.com
- Unblu Spark product page www.unblu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:38.
Original description (NVD)
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk. Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.