Cross-Site Scripting Vulnerability in Agent Zero Web UI by Agent Zero AI
CVE-2026-97635

8.6HIGH

Key Information:

Vendor

Agent Zero

Status
Agent Zero
Vendor
CVE Published:
22 October 2026

What is CVE-2026-97635?

An identified security flaw in the Agent Zero Web UI allows for cross-site scripting (XSS) attacks due to insufficient input sanitization. Prior to version 1.15, the application fails to properly clean user-generated content in chat messages and file uploads. This oversight enables attackers to inject malicious JavaScript that runs within the context of an authenticated user's session, potentially leading to unauthorized access and data breaches.

Affected Version(s)

Agent Zero 0 < 1.15

Agent Zero 1.15

References

https://github.com/agent0ai/agent-zero/releases/tag/v1.15
release-notes
https://github.com/agent0ai/agent-zero/issues/943
issue-tracking
https://www.cve.org/CVERecord?id=CVE-2026-97635
vdb-entry

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Wells, Vexel Foundation
Muhammad Ali, Vexel Foundation
.