CVE-2026-1721: When JSON.stringify() Betrays You in Cloudflare Agents

Vulnerability ID: CVE-2026-1721

CVSS Score: 6.2

Published: 2026-02-13

A classic Reflected Cross-Site Scripting (XSS) vulnerability found in the Cloudflare Agents AI Playground. The flaw stems from a misunderstanding of how browsers parse script tags within inline HTML, allowing attackers to break out of a JSON string context and execute arbitrary JavaScript. This exposes sensitive LLM chat history and connected Model Context Protocol (MCP) servers to unauthorized access.

TL;DR

Reflected XSS in Cloudflare Agents AI Playground (< 0.3.10) via OAuth callbacks. Developers used JSON.stringify inside a <script> block, assuming it was safe. It wasn't. Attackers can inject </script> to break out and steal chat logs or hijack MCP sessions.

⚠️ Exploit Status: POC

Technical Details

• 
  Vulnerability Type: Reflected Cross-Site Scripting (XSS)


• 
  CWE ID: CWE-79


• 
  CVSS Score: 6.2 (Medium)


• 
  Attack Vector: Network (Reflected)


• 
  Exploit Status: PoC Available


• 
  Impact: Session Hijacking, Data Exfiltration

Affected Systems

• Cloudflare Agents AI Playground


• Applications using agents package < 0.3.10


• Custom OAuth callback implementations based on the vulnerable example


• 
  Cloudflare Agents: < 0.3.10 (Fixed in: 0.3.10)

Code Analysis

Commit:

for more details including interactive diagrams and full exploit analysis.

Vollständiges Original-Advisory

Ausführliche Details, Exploit-Analyse & Hersteller-Stellungnahme auf dev.to.

↗ Original-Artikel auf dev.to lesen