CVE-2023-49296

The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from the browser. A vulnerability in versions prior to 1.3.6 affects the endpoint `/certificate.crt` and the way the web interface of the ArduinoCreateAgent handles custom error messages. An attacker that is able to persuade a victim into clicking on a malicious link can perform a Reflected Cross-Site Scripting attack on the web interface of the create agent, which would allow the attacker to execute arbitrary browser client side code. Version 1.3.6 contains a fix for the issue.

• CWE-79

• https://github.com/arduino/arduino-create-agent/commit/9a0e582bb8a1ff8e70d202943ddef8625ccefcc8Patch
• https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-j5hc-wx84-844hVendor Advisory
• https://github.com/arduino/arduino-create-agent/commit/9a0e582bb8a1ff8e70d202943ddef8625ccefcc8Patch
• https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-j5hc-wx84-844hVendor Advisory

Published

Dec 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49290lestrrat-go/jwx is a Go module implementing various JWx (JWA…5.3
• CVE-2023-49291tj-actions/branch-names is a Github action to retrieve branc…9.8
• CVE-2023-49292ecies is an Elliptic Curve Integrated Encryption Scheme for …4.8
• CVE-2023-49293Vite is a website frontend framework. When Vite's HTML trans…6.1
• CVE-2023-49294Asterisk is an open source private branch exchange and telep…7.5
• CVE-2023-49295quic-go is an implementation of the QUIC protocol (RFC 9000,…6.5
• CVE-2023-49297PyDrive2 is a wrapper library of google-api-python-client th…7.8
• CVE-2023-49298OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain s…7.5
• CVE-2023-49299Improper Input Validation vulnerability in Apache DolphinSch…8.8
• CVE-2023-4930The Front End PM WordPress plugin before 11.4.3 does not blo…6.5
• CVE-2023-4931Uncontrolled search path element vulnerability in Plesk Inst…7.8
• CVE-2023-49312Precision Bridge PrecisionBridge.exe (aka the thick client) …9.1