CVE-2026-14933
Deferred Deferred - Pending Action

XSS in Unblu Spark Agent Desk via Embedded Co-Browsing

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Switzerland Government Common Vulnerability Program

Description
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk. Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-14933
EUVD
EUVD-2026-104958

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Unblu inc. Unblu Spark 7.0
Unblu inc. Unblu Spark 8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Unblu Spark versions 7.0 through 7.57.7 and 8.0 through 8.39.2. An unauthenticated remote attacker in the visitor role can inject arbitrary JavaScript into the co-browsed page content. When an agent joins the session, the malicious script executes in the agent's browser under their session identity.

Detection Guidance

This vulnerability requires an agent to join an embedded co-browsing session with an attacker. Detection involves monitoring for suspicious co-browsing sessions or JavaScript execution in agent browsers. Check Unblu Spark logs for unauthorized session joins or unusual JavaScript activity in agent interfaces.

Impact Analysis

An attacker could steal sensitive data, perform actions on behalf of the agent, or compromise the agent's session. This requires an agent to join an embedded co-browsing session with the attacker. Mobile co-browsing is not affected.

Compliance Impact

This vulnerability allows an attacker to execute arbitrary JavaScript in an agent's browser during a co-browsing session, potentially enabling unauthorized access to sensitive data or session hijacking. This could lead to violations of GDPR (data protection) and HIPAA (patient data confidentiality) by exposing personal or health information during interactions.

Mitigation Strategies

Update Unblu Spark to a version that patches this vulnerability. If using versions 7.0 through 7.57.7 or 8.0 through 8.39.2, apply the latest security patches immediately. Disable embedded co-browsing features if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14933. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...