A reflected XSS flaw exists in the AI Playground OAuth callback handler where the error_description query parameter is directly interpolated into an inline <script> tag without any escaping. This allows an attacker to craft a malicious URL that, when opened by a target user, executes arbitrary JavaScript in the context of that user's session. Such code can read session data, harvest user chat history, and interact with any MCP servers the victim’s session is connected to, potentially executing actions on the victim’s behalf. The weakness is a classic CWE‑79 injection flaw.

Cloudflare AI Playground components that rely on the Cloudflare Agents SDK prior to version 0.3.10. Users who have integrated the SDK and use the configureOAuthCallback function with custom error handling are affected. Upgrading the Agents SDK to 0.3.10 or later removes the vulnerable code path and fixes the interpolation issue.

The CVSS score is 6.2, indicating a medium severity. EPSS is below 1%, suggesting a low yet non‑zero likelihood of exploitation; the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector requires a victim to click a specially crafted link, so it is a typical phishing or social engineering scenario. Once executed, the attacker can execute JavaScript in the victim’s browser, compromising confidentiality, integrity, and availability of the session data. The overall risk remains moderate due to the lack of widespread exploitation and the need for user interaction.