CVE-2026-108725: Cheshire Cat AI Core XSS Vulnerability

CVE-2026-108725 Overview

Cheshire Cat AI core through version 2.0.23 contains a stored cross-site scripting (XSS) vulnerability [CWE-79] in the uploads plugin. The flaw resides in the POST /uploads endpoint, which accepts file uploads without enforcing MIME type or extension restrictions. Authenticated users can upload arbitrary HTML files that are later served by the public GET /uploads/{path} endpoint. When a signed-in victim visits the attacker-supplied URL, the attacker's script executes in the application origin and gains access to the victim's access_token cookie, including administrator sessions.

Critical Impact
Authenticated attackers can hijack administrator sessions and perform actions in the application origin by delivering a crafted upload URL to a signed-in user.

Affected Products

Cheshire Cat AI core versions up to and including 2.0.23
The vulnerable uploads plugin component (src/cat/scaffold/plugins/uploads/endpoints.py)
Deployments exposing both POST /uploads and GET /uploads/{path} to authenticated users

Discovery Timeline

2026-10-11 - CVE-2026-108725 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108725

Vulnerability Analysis

The uploads plugin exposes a POST /uploads endpoint that writes caller-supplied files to a directory served publicly through GET /uploads/{path}. The handler does not validate the uploaded file type, extension, or Content-Type. Attackers with a low-privileged authenticated account can upload an .html payload containing arbitrary JavaScript. Because the file is served from the same origin as the Cheshire Cat application, retrieved scripts run with full access to same-origin resources, including the access_token cookie used for session authentication.

The attack requires user interaction: a signed-in victim must open the attacker-controlled GET /uploads/{path} URL. Once loaded, the script executes in the application origin and can exfiltrate session tokens or issue authenticated API calls on behalf of the victim. Administrator accounts targeted this way allow full compromise of the application's authenticated surface.

Root Cause

The root cause is missing input validation and insufficient output handling on the uploads endpoint. The handler accepts any file content and relies on the browser's MIME sniffing when serving responses. No Content-Disposition: attachment header, allow-list of extensions, or sandboxed origin is enforced. See the vulnerable handler in endpoints.py lines 28-96.

Attack Vector

An authenticated attacker submits a POST /uploads request containing an HTML file with embedded JavaScript. The server stores the file and returns a path reachable via GET /uploads/{path}. The attacker sends this URL to a signed-in victim. When loaded, the browser renders the HTML in the application origin and the script accesses the access_token cookie, exfiltrates it, or performs privileged actions. Technical write-ups are available in the HackMD analysis and the VulnCheck advisory.

Detection Methods for CVE-2026-108725

Indicators of Compromise

Files with .html, .htm, .svg, or .xhtml extensions present in the uploads directory
POST /uploads requests with Content-Type: text/html or multipart payloads containing <script> tags
GET /uploads/{path} requests referred from external domains or email clients
Outbound requests from browser sessions to attacker-controlled hosts shortly after accessing /uploads/

Detection Strategies

Inspect uploaded files in the Cheshire Cat storage path for HTML, SVG, or JavaScript content
Alert on POST /uploads responses that reference non-document extensions in the stored path
Correlate GET /uploads/{path} responses carrying Content-Type: text/html with authenticated session cookies in the same browser

Monitoring Recommendations

Log all requests to POST /uploads and GET /uploads/{path} with authenticated principal, source IP, and file metadata
Monitor for anomalous access patterns to the uploads directory from administrator accounts
Track egress traffic from administrator browser sessions for access_token values in query strings or POST bodies

How to Mitigate CVE-2026-108725

Immediate Actions Required

Restrict access to the /uploads routes to trusted authenticated users and block anonymous retrieval where feasible
Reject uploads whose extension or sniffed content indicates HTML, SVG, or scriptable formats
Rotate administrator access_token values and invalidate active sessions if abuse is suspected
Audit the uploads directory and remove any files containing HTML or script content

Patch Information

No fixed version is listed in the NVD entry at publication. Monitor the Cheshire Cat AI GitHub repository for a release addressing the uploads plugin. Until a patch is published, apply the workarounds below.

Workarounds

Place the uploads endpoint behind a separate, sandboxed origin or a dedicated subdomain without session cookies
Serve responses from GET /uploads/{path} with Content-Disposition: attachment and X-Content-Type-Options: nosniff
Enforce a strict Content-Security-Policy that disables inline script execution on the application origin
Mark the access_token cookie as HttpOnly and SameSite=Strict to limit script-based theft

bash

# Configuration example: reverse-proxy hardening for the uploads path
# Add nosniff and force download for files served from /uploads/
location /uploads/ {
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Disposition "attachment" always;
    add_header Content-Security-Policy "default-src 'none'; sandbox;" always;
}