What happened
The Agent Zero Web UI before 1.15 fails to sanitize user input in chat messages or file uploads, so injected JavaScript runs in the victim's authenticated session when content is rendered. CVSS 8.1 (v3.1) / 8.6 (v4.0), published 2026-10-22.
Why it matters
The UI of an autonomous agent framework is a session-boundary surface: stored XSS in the authenticated agent console can let an attacker hijack the operator's session, issue agent commands, and read the agent's private context and tool outputs.
Attack vector
User-provided chat messages or file uploads are not sanitized; when Agent Zero reproduces the content in the chat interface, injected JavaScript executes in the context of the victim's authenticated Agent Zero Web UI session (stored XSS, CWE-79).
Affected systems
Agent Zero Web UI before 1.15
Mitigation
Upgrade to Agent Zero Web UI 1.15+. Isolate/limit the Web UI's ambient authorization while patching and treat reproduced agent content as untrusted.