GHSA-cvhv-6xm6-c3v4
NoneCVSS
—
EPSS
—
Published
Feb 13, 2026
CISA due date
—
The record
Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | agents | 0 | 0.3.10 |
Related vulnerabilities
- CVE-2026-1721 Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI… Same vulnerability
- GHSA-w5cr-2qhr-jqc5 Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI… Also affects agents
- GHSA-r7x9-8ph7-w8cg Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email… Also affects agents
- CVE-2026-1664 Summary An Insecure Direct Object Reference has been found to exist in… Also affects agents
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79