CVE-2026-97635
Last modified
CVE-2026-97635 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Agent Zero | Agent Zero | < 1.15 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-97635?
How severe is CVE-2026-97635?
How do I fix CVE-2026-97635?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-97626Requesting a user or organization profile page (`GET /{usern…4.3
- CVE-2026-97627Hidden functionality issue exists in Multiple DVRs (Digital …8.6
- CVE-2026-97629Description When NGINX Plus or NGINX Open Source is configur…6.5
- CVE-2026-97630The FV Flowplayer Video Player plugin for WordPress is vulne…6.4
- CVE-2026-97631EDK2 contains a vulnerability in BIOS where a user may cause…9.5
- CVE-2026-97634The Event Tickets and Registration plugin for WordPress is v…6.5
- CVE-2026-97636Apache Airflow HashiCorp provider: the HashiCorp Vault secre…6.5
- CVE-2026-97637The JSON API Auth plugin for WordPress is vulnerable to Auth…9.8
- CVE-2026-97640The WPConsent – Cookie Banner & Cookie Consent for Privacy C…7.2
- CVE-2026-97641The Relevanssi – A Better Search plugin for WordPress is vul…7.2
- CVE-2026-97643The GiveWP – Donation Plugin and Fundraising Platform plugin…6.4
- CVE-2026-97644The Groundhogg — CRM, Newsletters, and Marketing Automation …8.8
Are you affected by CVE-2026-97635?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST