CVE-2026-63169: Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is stored and automatically rendered to other channel members, enabling zero-click drive-by downloads and framed JavaScript execution in recipients' browsers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Omnispace Agora Projectto a version that resolves this vulnerability.Fixed in 26.10.0
Event History
Frequently Asked Questions
Which deployments are affected?
Omnispace Agora Project versions before 26.10.0 are affected. Version 26.10.0 is identified as the release containing the fix.
What access does an attacker need, and who is exposed?
An attacker needs an authenticated account able to post messages through the messenger. Other members of the channel containing the malicious message are exposed when the stored iframe is automatically rendered in their browsers.