GHSA-9cpr-c5m9-prfrMediumCVSS 5.4
ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users...
🔗 CVE IDs covered (1)
📋 Description
ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-129158
- https://github.com/nageoffer/ragent/issues/187
- https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/knowledge/controller/KnowledgeDocumentController.java#L187-L198
- https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/knowledge/controller/KnowledgeDocumentController.java#L71-L82
- https://vul.yulun.ac.cn/20261104/ragent
- https://www.vulncheck.com/advisories/ragent-1.1.0-stored-xss-via-svg-knowledge-base-document-upload
- https://github.com/advisories/GHSA-9cpr-c5m9-prfr