CVE-2026-2099: AgentFlow Stored XSS Vulnerability

CVE-2026-2099 Overview

AgentFlow, a workflow automation platform developed by Flowring, contains a Stored Cross-Site Scripting (XSS) vulnerability that allows authenticated remote attackers to inject persistent malicious JavaScript code into the application. When other users access affected pages, the injected scripts are automatically executed in their browsers, potentially leading to session hijacking, credential theft, and unauthorized actions performed on behalf of legitimate users.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in victim browsers upon page load, enabling session hijacking, data theft, and malicious actions on behalf of users.

Affected Products

Flowring AgentFlow (specific versions not disclosed)

Discovery Timeline

2026-02-10 - CVE-2026-2099 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-2099

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Stored Cross-Site Scripting. Unlike reflected XSS attacks that require victims to click malicious links, stored XSS vulnerabilities persist within the application's database or storage layer. When authenticated users with malicious intent submit crafted input containing JavaScript payloads, the application fails to properly sanitize or encode this content before storing it. Subsequently, when other users view pages containing the stored content, the malicious scripts execute within the context of their authenticated browser sessions.

The attack requires network access and low privileges (authentication), along with some user interaction (accessing the affected page). The vulnerability primarily impacts users in the downstream system through the execution of malicious scripts in their browser context, potentially affecting confidentiality and integrity of their sessions.

Root Cause

The root cause of this vulnerability lies in inadequate input validation and output encoding mechanisms within the AgentFlow application. The application accepts user-supplied input without properly sanitizing potentially dangerous characters or HTML/JavaScript content. When this unsanitized data is later rendered on web pages, it is not properly escaped or encoded, allowing embedded script tags and event handlers to execute as active code rather than being displayed as harmless text.

Attack Vector

The attack follows a typical stored XSS pattern: An authenticated attacker identifies an input field within AgentFlow that accepts and stores user data—such as form fields, comment sections, or profile information. The attacker submits malicious JavaScript code disguised within legitimate-looking input. Because the application lacks proper input validation and output encoding, this payload is stored in the database. When other users navigate to pages that display this stored content, their browsers interpret and execute the injected JavaScript code within the application's security context.

The malicious scripts can perform various harmful actions including stealing session cookies, capturing keystrokes, redirecting users to phishing sites, modifying page content, or making unauthorized API calls on behalf of the victim. Technical details and additional exploitation information may be available in the TWCERT Security Alert.

Detection Methods for CVE-2026-2099

Indicators of Compromise

Unusual JavaScript code or HTML tags appearing in stored user content fields
Browser console errors or unexpected script execution warnings when viewing user-generated content
Unexpected outbound connections to external domains when accessing AgentFlow pages
User reports of suspicious behavior or unauthorized actions within their sessions

Detection Strategies

Implement Content Security Policy (CSP) headers with violation reporting to detect unauthorized script execution attempts
Deploy Web Application Firewall (WAF) rules to identify and log XSS payload patterns in HTTP requests
Enable detailed application logging for input fields that store user-generated content
Use browser security extensions or endpoint protection that can detect and block malicious script execution

Monitoring Recommendations

Monitor web server logs for requests containing common XSS payloads such as <script>, javascript:, onerror=, and encoded variants
Configure alerts for Content Security Policy violation reports from client browsers
Establish baseline behavior for AgentFlow and alert on anomalous patterns in user input submissions
Review stored content periodically for signs of injected scripts or suspicious HTML markup

How to Mitigate CVE-2026-2099

Immediate Actions Required

Review and audit all user-generated content currently stored in AgentFlow for evidence of injected scripts
Implement or strengthen Content Security Policy (CSP) headers to restrict script execution sources
Deploy Web Application Firewall rules to block common XSS attack patterns at the network perimeter
Consider temporarily restricting access to affected input functionality until patches are applied

Patch Information

Organizations using Flowring AgentFlow should consult the TWCERT Security Advisory for official patch information and remediation guidance. Contact Flowring directly for information about security updates that address this stored XSS vulnerability.

Workarounds

Implement strict Content Security Policy headers that disable inline script execution (script-src 'self')
Deploy input validation on the server-side to strip or encode HTML special characters from user input
Apply output encoding (HTML entity encoding) when rendering user-supplied content on web pages
Use HTTP-only and Secure flags on session cookies to limit the impact of potential cookie theft
Consider implementing a web application firewall with XSS protection rules as an additional defense layer

bash

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or Apache configuration file
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self';"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"