Agent Zero version 1.14 and earlier contains a stored cross‑site scripting flaw in the image_get API endpoint. Attackers can upload a crafted SVG file containing script tags to a directory readable by the agent‑zero process. When an authenticated user visits the image_get URL, the browser executes the malicious JavaScript in the context of the application origin, allowing the attacker to steal the csrf_token cookie and perform unauthorized API requests on the victim’s behalf.

Vendors: 3clyp50, Product: agent-zero, Versions: all releases prior to 1.15. Any installation that stores files in paths readable by the agent‑zero process and exposes the image_get endpoint is affected.

This vulnerability has a CVSS score of 5.3, indicating moderate overall risk. EPSS is not available and the issue is not listed in CISA KEV. An attacker must first upload a malicious SVG to a server location accessible to agent‑zero and then convince an authenticated user to access the image_get URL. The attack is confined to the victim’s browser session and requires the user to be actively redirected or lured to the crafted URL. Because it relies on user interaction and file placement, exploitation is plausible but not trivially automated.