Agent-zero vulnerabilities
We track 2 vulnerabilities in Agent-zero products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
2vulnerabilities
0critical
2high
0exploited
8.3average CVSS score
Latest Agent-zero vulnerabilities
- 8.1 High severity
Agent Zero: Improper Neutralization of Input During Web Page Generation
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent
- 8.6 High severity
Agent-zero: Improper Neutralization of Special Elements used in a Command
Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are exec