The vulnerability is a stored cross‑site scripting flaw that allows authenticated users to embed attacker‑controlled iframes in chat messages via the messenger component’s HTMLPurifier SafeIframe branch. When a malicious message is posted, the embedded iframe is stored and rendered automatically for all channel members, providing a zero‑click drive‑by download path and allowing the attacker to execute arbitrary JavaScript in the recipients’ browsers.

Omnispace Agora Project versions earlier than 26.10.0 are affected. The issue exists in all releases prior to that point, regardless of the minor revision.

With a CVSS score of 5.3 the vulnerability is considered moderate, but the EPSS score of less than 1% indicates a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with the ability to post messages in a channel, after which the stored iframe is automatically delivered to other channel members. Attackers can achieve drive‑by downloads or execute JavaScript without further interaction from victims, making this a low‑interaction yet potentially damaging flaw.