PT-2026-113377

CVE-2026-63169

Published

2026-10-13

Updated

2026-10-17

Description by

CVSS 3.1

6.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description A stored cross-site scripting issue exists that allows authenticated users to post messages containing attacker-controlled iframes via the messenger's HTMLPurifier SafeIframe branch. This allows attackers to send malicious iframes that are stored and automatically rendered for other channel members, facilitating zero-click drive-by downloads and framed JavaScript execution in the browsers of recipients.

Recommendations Update to version 26.10.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Geoffrey Robert

Valentin Holubec

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')