Executive brief
Cloudflare Agents is a framework for building AI-powered applications. A reflected cross-site scripting vulnerability in its AI Playground OAuth callback handler allows attackers to steal user session data, including chat history, LLM interactions, and access to connected servers, by tricking users into clicking a malicious link.
Technical details
The vulnerability is a reflected XSS (CWE-79) in the OAuth callback handler at site/ai-playground/src/server.ts. The error_description query parameter is directly interpolated into an inline HTML script tag without proper escaping. An attacker crafts a malicious URL containing JavaScript payload in the error_description parameter; when a victim visits the link, the script executes in their browser session context. The attack requires user interaction (clicking the link) and network access. An attacker can steal chat history, access LLM interactions, and interact with connected MCP servers on behalf of the victim. The fix is available in agents@0.3.10 and commit 3f490d045844e4884db741afbb66ca1fe65d4093, which properly escapes user-controlled input.
Affected products
- Cloudflare Agents before 0.3.10
Timeline
- 2026-02-13: disclosed
- 2026-02-04: patched: Fix merged in PR #841; agents@0.3.10 released