Executive brief
Cloudflare Agents is a JavaScript library that enables developers to build AI-powered applications and integrations. A reflected cross-site scripting (XSS) vulnerability in the AI Playground's OAuth authentication flow allows an attacker to inject and execute malicious code in a victim's browser session, potentially stealing chat history, accessing connected data sources, and performing unauthorized actions on behalf of the victim.
Technical details
The vulnerability is a reflected XSS (CWE-79) in the OAuth callback handler at site/ai-playground/src/server.ts, where the error_description query parameter is directly interpolated into an inline <script> tag without proper HTML escaping. An attacker can craft a malicious URL containing JavaScript payload in the error_description parameter; when a victim clicks the link and is redirected to the OAuth callback, the payload executes in their browser context with access to their session. The attack requires user interaction (clicking a malicious link) but no authentication. Exploitation allows theft of chat message history and unauthorized interaction with MCP (Model Context Protocol) servers connected to the victim's account. The fix (PR #841 and agents@0.3.10) implements proper HTML escaping of the error_description parameter before interpolation.
Affected products
- Cloudflare Agents before 0.3.10
Timeline
- 2026-02-13: disclosed
- 2026-02-04: patched: Fix merged in PR #841; patch released as agents@0.3.10