CVE-2026-2099: AgentFlow Stored XSS Vulnerability

CVE-2026-2099 Overview

AgentFlow, a workflow automation platform developed by Flowring, contains a Stored Cross-Site Scripting (XSS) vulnerability that allows authenticated remote attackers to inject persistent malicious JavaScript code into the application. When other users access affected pages, the injected scripts are automatically executed in their browsers, potentially leading to session hijacking, credential theft, and unauthorized actions performed on behalf of legitimate users.

Critical Impact

Authenticated attackers can inject persistent JavaScript that executes in victim browsers upon page load, enabling session hijacking, data theft, and malicious actions on behalf of users.

Affected Products

• Flowring AgentFlow (specific versions not disclosed)

Discovery Timeline

• 2026-02-10 - CVE-2026-2099 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-2099

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Stored Cross-Site Scripting. Unlike reflected XSS attacks that require victims to click malicious links, stored XSS vulnerabilities persist within the application's database or storage layer. When authenticated users with malicious intent submit crafted input containing JavaScript payloads, the application fails to properly sanitize or encode this content before storing it. Subsequently, when other users view pages containing the stored content, the malicious scripts execute within the context of their authenticated browser sessions.

The attack requires network access and low privileges (authentication), along with some user interaction (accessing the affected page). The vulnerability primarily impacts users in the downstream system through the execution of malicious scripts in their browser context, potentially affecting confidentiality and integrity of their sessions.

Root Cause

The root cause of this vulnerability lies in inadequate input validation and output encoding mechanisms within the AgentFlow application. The application accepts user-supplied input without properly sanitizing potentially dangerous characters or HTML/JavaScript content. When this unsanitized data is later rendered on web pages, it is not properly escaped or encoded, allowing embedded script tags and event handlers to execute as active code rather than being displayed as harmless text.

Attack Vector

The attack follows a typical stored XSS pattern: An authenticated attacker identifies an input field within AgentFlow that accepts and stores user data—such as form fields, comment sections, or profile information. The attacker submits malicious JavaScript code disguised within legitimate-looking input. Because the application lacks proper input validation and output encoding, this payload is stored in the database. When other users navigate to pages that display this stored content, their browsers interpret and execute the injected JavaScript code within the application's security context.

The malicious scripts can perform various harmful actions including stealing session cookies, capturing keystrokes, redirecting users to phishing sites, modifying page content, or making unauthorized API calls on behalf of the victim. Technical details and additional exploitation information may be available in the TWCERT Security Alert.

Detection Methods for CVE-2026-2099

Indicators of Compromise

• Unusual JavaScript code or HTML tags appearing in stored user content fields
• Browser console errors or unexpected script execution warnings when viewing user-generated content
• Unexpected outbound connections to external domains when accessing AgentFlow pages
• User reports of suspicious behavior or unauthorized actions within their sessions

Detection Strategies

• Implement Content Security Policy (CSP) headers with violation reporting to detect unauthorized script execution attempts
• Deploy Web Application Firewall (WAF) rules to identify and log XSS payload patterns in HTTP requests
• Enable detailed application logging for input fields that store user-generated content
• Use browser security extensions or endpoint protection that can detect and block malicious script execution

Monitoring Recommendations

• Monitor web server logs for requests containing common XSS payloads such as <script>, javascript:, onerror=, and encoded variants
• Configure alerts for Content Security Policy violation reports from client browsers
• Establish baseline behavior for AgentFlow and alert on anomalous patterns in user input submissions
• Review stored content periodically for signs of injected scripts or suspicious HTML markup

How to Mitigate CVE-2026-2099

Immediate Actions Required

• Review and audit all user-generated content currently stored in AgentFlow for evidence of injected scripts
• Implement or strengthen Content Security Policy (CSP) headers to restrict script execution sources
• Deploy Web Application Firewall rules to block common XSS attack patterns at the network perimeter
• Consider temporarily restricting access to affected input functionality until patches are applied

Patch Information

Organizations using Flowring AgentFlow should consult the TWCERT Security Advisory for official patch information and remediation guidance. Contact Flowring directly for information about security updates that address this stored XSS vulnerability.

Workarounds

• Implement strict Content Security Policy headers that disable inline script execution (script-src 'self')
• Deploy input validation on the server-side to strip or encode HTML special characters from user input
• Apply output encoding (HTML entity encoding) when rendering user-supplied content on web pages
• Use HTTP-only and Secure flags on session cookies to limit the impact of potential cookie theft
• Consider implementing a web application firewall with XSS protection rules as an additional defense layer

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or Apache configuration file
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self';"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"