agent-zero vulnerabilities

CVEs whose affected-version data names the agent-zero package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-47119Medium· 6.1

5mo ago

Agent Zero < 1.15 Stored XSS via image_get API Endpoint

Agent Zero before version 1.15 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript in the application origin by serving SVG files through the image_get API endpoint without Content-S…

▾ Sunlitagent0ai · agent-zeroEPSS 0.24%via CVEORG