Vulnerability · Published Oct 22, 2026 · Assigned by cisa-cg
CVE-2026-97635Agent Zero Web UI XSS
High 8.1
In plain English
A high-severity cross-site scripting in Agent Zero from Agent Zero. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 82.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Agent Zero | Agent Zero | 0 – before 1.15 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N