Stored Cross-Site Scripting Vulnerability in ragent by Nageoffer
CVE-2026-129158

5.1MEDIUM

Key Information:

Vendor

Nageoffer

Status
Ragent
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129158?

The application ragent version 1.1.0 is susceptible to a stored cross-site scripting vulnerability, enabling authenticated users to upload malicious SVG documents. This occurs via the document upload feature in the application's knowledge base section. Attackers can inject harmful scripts into these SVG files, which, upon being accessed by other users, execute in the context of the application origin, potentially leading to account takeover and unauthorized access.

Affected Version(s)

ragent 1.1.0

References

https://vul.yulun.ac.cn/20261104/ragent/
third-party-advisory
https://github.com/nageoffer/ragent/issues/187
issue-tracking
https://github.com/nageoffer/ragent/blob/f64de341452c8998...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.