CVE-2026-97635

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97635
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97635.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97635
Published
2026-10-22T17:57:24Z
Modified
2026-10-23T02:46:14Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Agent Zero Web UI XSS
Details

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.

Database specific 
{
    "cna_assigner":  "cisa-cg",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97635.json"
}
References

Affected packages

Git / github.com/agent0ai/agent-zero

Affected ranges

Type
GIT
Repo
https://github.com/agent0ai/agent-zero
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6664fc7f38867d0e995d4eed7be2cb46932b87f7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.15"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "original_tag":  "v1.15",
            "range":  [
                {
                    "fixed":  "6664fc7f38867d0e995d4eed7be2cb46932b87f7"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.2
v0.3
v0.4
v0.5
v0.6
v0.6.1
v0.6.2
v0.7
v0.7.1
v0.8
v0.8.1
v0.8.1.2
v0.8.2
v0.8.2.1
v0.8.3
v0.8.3.1
v0.8.4
v0.8.4.1
v0.8.4.2
v0.8.5
v0.8.5.1
v0.8.6
v0.8.7
v0.9.0
v0.9.1
v0.9.1-pre
v0.9.1.1
v0.9.1.2
v0.9.3-pre
v0.9.4-pre
v0.9.5
v0.9.5-pre
v0.9.5.1
v0.9.6-pre
v0.9.7
v0.9.7-pre
v0.9.8
v0.9.8-pre
v0.9.9.0
v0.9.9.1
v0.9.9.2
v0.9.9.3
v0.9.9.4
v0.9.9.5
v1.*
v1.0
v1.1
v1.10
v1.11
v1.12
v1.13
v1.14
v1.2
v1.3
v1.4
v1.5
v1.6
v1.7
v1.8
v1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97635.json"