Agent Zero CVE-2026-97635

Exploitation requires that attacker-controlled text reach a chat message or an uploaded file that Agent Zero then reproduces/renders in the chat interface (specifically the chat markdown rendering path fixed in v1.15), and that an authenticated victim subsequently views that rendered content - this is the UI:P/user-interaction requirement and the primary limiting factor. The vulnerability is limited to Agent Zero Web UI versions before 1.15; instances already on 1.15 or later are not affected because markdown is now sanitized. Impact is confined to the victim's authenticated Web UI session context (VC:H/VI:H, no subsequent-system impact), so realistic risk scales with how exposed and how actively used a given Agent Zero deployment is.

This is a cross-site scripting flaw (CWE-79) in the Agent Zero Web UI before 1.15, where unsanitized user input in chat messages or file uploads is rendered back and executed in the victim's authenticated session. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:H/VI:H/VA:N, no subsequent-system impact) scores 8.6 and reflects a network-reachable, low-complexity issue that still requires victim interaction (UI:P) - the victim must view the attacker-supplied content for the script to fire. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT on the CISA KEV list, so there is no confirmed active exploitation. GitHub issue #943 is referenced but is a tracker/report link, not verified working exploit code, so no public exploit is confirmed. The vuln.today decision label is 'this_week', consistent with a patched, network-facing XSS that is serious but not an active-exploitation emergency. The dominant signals - patched, web vector, interaction-dependent, no KEV, no confirmed EPSS/POC - point to a genuine but non-emergency priority: patch within the week as the decision label indicates. The main caveat is that VC:H/VI:H (high confidentiality and integrity impact) reflects full compromise of the authenticated UI session rather than host-level impact, which should be weighed against how exposed the instance is.

An attacker places malicious JavaScript into content that Agent Zero will reproduce in the chat interface - either directly in a chat message or inside an uploaded file - such as content the agent fetches or echoes back. When the authenticated victim views that rendered content in the Web UI, the script executes in their session context, enabling session/data theft or actions performed as the victim. A GitHub issue reference (#943) exists but there is no input confirmation of verified working exploit code.