PT-2026-7962 · Agents+1 · Agentis+1

Nishant Kumawat

·

Published

2026-02-13

·

Updated

2026-05-06

·

CVE-2026-1721

CVSS v4.0

6.2

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
Name of the Vulnerable Software and Affected Versions AI Playground versions prior to 0.3.10
Description A Reflected Cross-Site Scripting (XSS) issue exists in the AI Playground's OAuth callback handler. The error description query parameter is directly interpolated into an HTML script tag without proper escaping, enabling attackers to execute arbitrary JavaScript within the victim's session. An attacker could craft a malicious link that, when clicked by a victim, could allow access to user chat message history and interaction with connected MCP Servers, potentially enabling the attacker to perform actions on the victim's behalf. The issue stems from the direct interpolation of the authError value, sourced from the error description query parameter, into an inline <script> tag within the site/ai-playground/src/server.ts file.
Recommendations Upgrade to agents@0.3.10. Developers using configureOAuthCallback with custom error handling in their own applications should ensure all user-controlled input is escaped before interpolation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1721
GHSA-CVHV-6XM6-C3V4

Affected Products

Ai Playground
Agentis