Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/GHSA-W5CR-2QHR-JQC5.md

Created February 13, 2026 21:40
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/3f68debf1f3d91d55f13d27e858d34ca to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/3f68debf1f3d91d55f13d27e858d34ca to your computer and use it in GitHub Desktop.
Download ZIP
GHSA-W5CR-2QHR-JQC5: Agent Provocateur: Breaking the Fourth Wall in Cloudflare's AI Playground - CVE Security Report
Raw
GHSA-W5CR-2QHR-JQC5.md

GHSA-W5CR-2QHR-JQC5: Agent Provocateur: Breaking the Fourth Wall in Cloudflare's AI Playground

CVSS Score: 6.2 Published: 2026-02-13 Full Report: https://cvereports.com/reports/GHSA-W5CR-2QHR-JQC5

Summary

In the rush to connect Large Language Models (LLMs) to the real world via the Model Context Protocol (MCP), developers often overlook the plumbing. CVE-2026-1721 is a classic Reflected Cross-Site Scripting (XSS) vulnerability found in the Cloudflare Agents SDK's OAuth callback handler. By abusing how error messages are serialized into HTML, attackers could hijack a developer's session, stealing sensitive AI chat logs and potentially commanding connected agents to perform unauthorized actions.

TL;DR

The Cloudflare Agents SDK used JSON.stringify() to render OAuth error messages directly inside an HTML <script> tag. Since this function doesn't escape forward slashes, attackers could close the script block with </script> and inject malicious JavaScript. This grants full access to the AI Playground session.

Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • CVSS Score: 6.2 (Medium)
  • Attack Vector: Network
  • User Interaction: Required (Clicking Link)
  • Impact: Session Hijacking / Data Exfiltration
  • Exploit Status: Proof of Concept (PoC) Available

Affected Systems

  • Cloudflare Agents SDK (< 0.3.10)
  • Cloudflare AI Playground
  • Applications implementing MCP Client with default OAuth callbacks
  • cloudflare/agents: < 0.3.10 (Fixed in: 0.3.10)

Mitigation

  • Input Sanitization: Use libraries like escape-html or he to sanitize data before rendering.
  • Context-Aware Output Encoding: Understand the difference between JavaScript string escaping and HTML entity encoding.
  • Architecture Change: Avoid reflecting input in the OAuth callback page entirely; use session state or nonces.

Remediation Steps:

  1. Update cloudflare/agents SDK to version 0.3.10 or higher.
  2. Audit any custom OAuth callback handlers in your own applications for similar JSON.stringify usage patterns inside <script> tags.
  3. Implement Content Security Policy (CSP) headers to restrict inline script execution.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment