Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2 contain a cross‑site scripting flaw in the embedded co‑browsing feature that allows an unauthenticated attacker in the visitor role to inject and run arbitrary JavaScript in the browser of any agent who joins the co‑browsing session. The injected code runs with the cookie‑based credentials of the agent and therefore can read session data, steal credentials, or manipulate the agent’s workflow, effectively enabling remote code execution within the agent’s environment.

Unblu inc.'s Unblu Spark is affected. All on‑premises deployments using product versions 7.0 to 7.57.7 or 8.0 to 8.39.2 are vulnerable. Cloud customers are already protected because the vendor has deployed the fix in Unblu Cloud.

The flaw carries a CVSS score of 8.6, indicating high severity. The exploit requires the attacker to be able to send a malicious co‑browsed page to an agent, but it does not require any special configuration or user interaction beyond the typical co‑browsing workflow. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred as an attacker-controlled visitor initiating a co‑browsing session that includes malicious HTML, making exploitation possible in environments where visitor access is freely granted and agents routinely participate in co‑browsing without additional safeguards.