Executive brief
Agent Zero, an AI agent framework, is vulnerable to a security flaw in how it handles image files. An attacker can trick a user into opening a specially crafted image file (SVG) that executes malicious code in the user's browser. This could allow the attacker to steal login tokens or perform unauthorized actions on behalf of the user within the application.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Agent Zero's `/api/image_get` endpoint due to insufficient path validation and missing security headers. While the application implements an extension allowlist, it fails to enforce directory containment, allowing the retrieval of image-extension files from any location readable by the process. When a malicious SVG file containing script tags is requested, the server fails to provide a Content-Security-Policy (CSP), X-Content-Type-Options, or Content-Disposition header. This allows the script to execute within the application's origin, enabling an attacker to exfiltrate CSRF tokens and perform unauthorized API requests. The issue is fixed in version 1.15 by implementing symlink-aware path validation and hardening SVG responses with a sandboxed CSP.
Affected products
- agent0ai Agent Zero < 1.15
Timeline
- 2026-05-07: disclosed: Issue reported to vendor via GitHub
- 2026-05-12: patched: Fix committed to repository
- 2026-05-27: advisory: CVE published and NVD record created