CVE-2026-63169

Deferred Deferred - Pending Action

Stored XSS in Omnispace Agora Project

Publication date: 2026-10-13

Last updated on: 2026-10-17

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is stored and automatically rendered to other channel members, enabling zero-click drive-by downloads and framed JavaScript execution in recipients' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-17

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63169

EUVD

EUVD-2026-100478

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project before version 26.10.0. Authenticated users can send messages containing malicious iframes through the messenger's HTMLPurifier SafeIframe feature. These iframes are stored and automatically rendered to other channel members, allowing attackers to execute code in victims' browsers without any interaction.

Detection Guidance

Detecting this vulnerability requires checking for stored XSS in the Omnispace Agora Project messenger. Inspect messages for iframe tags or JavaScript execution in the HTMLPurifier SafeIframe branch. Monitor browser console logs for unexpected script execution when viewing messages.

Impact Analysis

Attackers could exploit this to perform zero-click drive-by downloads or execute JavaScript in your browser. This could lead to theft of session cookies, account takeover, or installation of malware on your device without any action required on your part.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information integrity and confidentiality. Organizations using affected software may face compliance violations and potential fines.

Mitigation Strategies

Upgrade Omnispace Agora Project to version 26.10.0 or later to patch the vulnerability. Disable HTMLPurifier SafeIframe functionality if not required. Implement input validation for messages to block iframe tags and JavaScript. Restrict message rendering to plain text where possible.

Hi! I’m here to help you understand CVE-2026-63169. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70