CVE-2026-97635

{
  "etk_id": "ETK-2026-2485",
  "cve_id": "CVE-2026-97635",
  "display_id": "CVE-2026-97635",
  "ghsa_id": "GHSA-mw3v-p424-652w",
  "euvd_id": "EUVD-2026-108272",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Agent Zero Web UI",
  "summary": "Agent Zero Web UI versions before 1.15 insufficiently sanitize content submitted through chat messages and file uploads. An attacker can cause JavaScript to run in an authenticated user's Web UI session when the submitted content is displayed; the user must view the attacker-controlled content.",
  "mitigation": "Upgrade Agent Zero to version 1.15 or later. Until upgraded, restrict untrusted users from submitting chat content or uploading files and avoid viewing untrusted content in the Web UI.",
  "vendor": "Agent Zero",
  "product": "Agent Zero",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.15"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.15"
      ],
      "package_name": "Agent Zero",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-10-22T17:57:24.056000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T17:57:24.056000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T17:57:24.056000+00:00",
      "url": "https://github.com/advisories/GHSA-mw3v-p424-652w"
    }
  }
}