What happened
Cheshire Cat AI core through 2.0.23 stores uploaded HTML files without type restrictions in the uploads plugin and serves them from the application origin. An authenticated user uploads a hostile HTML file and sends the public URL to a signed-in victim, whose browser executes the script with the victim's access_token cookie — including administrators.
Why it matters
An LLM chat/agent platform where a normal user can collude with a crafted upload to run script in the admin session opens a path to privilege escalation over the whole AI application (plugin configuration, prompt stores, model credentials).
Attack vector
Authenticated user uploads an HTML file via POST /uploads (no type restriction). The public GET /uploads/{path} URL served from the app origin is sent to a signed-in victim (including admins); the payload runs in the application origin with the victim's access_token cookie.
Affected systems
cheshire-cat-ai/core <= 2.0.23 (uploads plugin)
Mitigation
No released fix at publication; restrict upload MIME types and serve uploads from a separate content-neutral origin/domain (see VulnCheck advisory).