Agent Zero Web UI: Cross-site scripting in chat messages and file uploads

Summary

The Agent Zero Web UI before version 1.15 does not correctly sanitize user-supplied input in chat messages or file uploads. When the chat interface renders such content, injected JavaScript runs in the browser session of the victim who is logged in to the Web UI. An attacker could use this to hijack sessions or manipulate the interface, provided a user views the malicious content and the attacker can deliver it.

Affected

• Agent Zero Web UI, all versions before 1.15 (CNA: 0 to less than 1.15)

Fixed in

• Version 1.15 (chat markdown output is sanitized according to the release notes)

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof-of-concept found.
• Reported to the vendor as GitHub issue #943 and recorded by Positive Technologies as PT-2026-121494.

Our recommendation

• Inventory all Agent Zero instances, including Docker containers, and record their versions.
• Upgrade to version 1.15 or later, then verify the file-upload handling against the vendor's release notes, as the release notes only confirm the fix for chat markdown rendering.
• Do not expose the Web UI directly to the internet; restrict access to VPN or internal networks.
• Monitor GitHub issue #943 and the CISA advisory for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record www.cve.org
• GitHub Issue #943 github.com
• GitHub Release v1.15 github.com
• CISA CSAF advisory VA-26-296-01 raw.githubusercontent.com
• VulDB entry vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:15.