Skip to content
OpenAdvisories

Package · npm

agents

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium —
    GHSA-w5cr-2qhr-jqc5

    Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site

    ## Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The error_description query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers t…

    agents npm
  • Medium 6.2
    CVE-2026-1721

    Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site

    Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The `error_description` query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers to…

    agents npm
  • Medium 6.9
    CVE-2026-1664

    Insecure Direct Object Reference (IDOR) via Header-Based Email Routing

    Summary An Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare Agents SDK. The issue occurs because the `Message-ID` and `References` headers are parsed to derive the target agentName a…

    agents npm