CVE-2026-47119
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Agent Zero before version 1.15 contains a stored cross-site scripting vulnerability. An attacker can place a crafted SVG file with JavaScript code in a path readable by the agent-zero process and then trick an authenticated user into visiting the image_get endpoint, causing the browser to execute the malicious script.
Risk Assessment
The risk involves the potential theft of the csrf_token cookie by the attacker, enabling unauthorized API calls on behalf of the victim. This could lead to account takeover, data theft, or other harmful actions within the system.
Recommendation
Immediately update Agent Zero to version 1.15 or later. Additionally, implement Content-Security-Policy, X-Content-Type-Options, and Content-Disposition headers for the image_get endpoint to prevent script execution from SVG files.
Other vulnerabilities in Agent Zero
See all- CVE-2026-51853Unknown
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction.
- CVE-2026-51852Unknown
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.
- CVE-2026-47118Medium
Agent Zero before version 1.15 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying crafted paths to the image file serving endpoint. The security mechanism relies solely on an extension allowlist while path containment checking is explicitly disabled.
Original NVD description (English source)
Agent Zero before version 1.15 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript in the application origin by serving SVG files through the image_get API endpoint without Content-Security-Policy, X-Content-Type-Options, or Content-Disposition headers. Attackers can place a crafted SVG file containing script tags in any path readable by the agent-zero process and lure an authenticated user to the image_get endpoint, causing the browser to execute the malicious script, steal the csrf_token cookie, and perform unauthorized API calls on behalf of the victim.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS