# CVE-2026-97635: Agent Zero Web UI stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-97635-the-agent-zero-web-ui-before-1-15-does-not-correctly-sanitize  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-97635 · Severity: high · CVSS 8.1 · Published 2026-10-22

Agent Zero is an AI agent web interface that allows users to chat and upload files. The Web UI before version 1.15 fails to properly sanitize user-provided content in chat messages and file uploads, allowing attackers to inject malicious JavaScript that executes in other users' browsers when they view the content. This can lead to session hijacking, credential theft, and account takeover for any user reviewing messages or artifacts.

Vendors: [Agent0ai](https://junglewise.ai/threats/vendors/agent0ai).

## Quick answers

**Is CVE-2026-97635 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97635 being exploited in the wild.

**How severe is CVE-2026-97635?** High severity, with a CVSS score of 8.1, published 22 October 2026.

**Which products and versions are affected?** Agent0ai Agent Zero Web UI before 1.15.

**Is there a fix for CVE-2026-97635?** Yes: fixed in 1.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97635 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97635?** Check whether you run Agent0ai Agent Zero Web UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.15

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the chat markdown rendering and artifact display components of the Web UI. User-supplied content is rendered without proper HTML/JavaScript sanitization, allowing injected payloads (e.g., img onerror handlers or script tags) to execute in the authenticated session context of users viewing message history. The vulnerability is network-accessible via the web UI and requires only that a victim view previously injected content; no additional privileges or user interaction is required beyond normal product usage.

## Affected products

- agent0ai Agent Zero Web UI before 1.15

## Timeline

- 2026-01-22: disclosed
- 2026-05-17: patched

## References

- [https://github.com/agent0ai/agent-zero/issues/943](https://github.com/agent0ai/agent-zero/issues/943)
- [https://github.com/agent0ai/agent-zero/releases/tag/v1.15](https://github.com/agent0ai/agent-zero/releases/tag/v1.15)