Description

Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:17:04.190Z",
  "pubdate": "2026-08-13T14:17:04.190Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Agrion product affecting versions <= 1.0.0. This security flaw enables remote attackers to inject malicious client-side scripts, typically written in JavaScript, into web pages rendered by unsuspecting users. The primary impact of this vulnerability includes session hijacking, credential theft, malicious redirection, and the unauthorized execution of arbitrary actions within the context of the victim's browser session.\nThe vulnerability resides within the application's input handling mechanisms, where user-supplied data is improperly sanitized or encoded before being reflected back in the HTTP response. Because the attack vector is unauthenticated, any remote adversary with network access to the target web application can initiate exploitation without requiring prior credentials or elevated privileges. The prerequisite for successful exploitation relies on tricking a legitimate user into interacting with a crafted URL or malicious payload vector.\nOrganizations utilizing Agrion <= 1.0.0 face significant risk implications, as successful exploitation undermines the integrity and confidentiality of user sessions interacting with the web application. Given the unauthenticated nature and the client-side impact, remediation is critical to prevent automated exploitation and potential compromise of user data.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw, specifically stemming from inadequate input sanitization and output encoding within the Agrion product <= 1.0.0. The root cause of the issue lies in the application's failure to properly validate, sanitize, or contextually encode user-supplied parameters before reflecting them within the Document Object Model (DOM) or HTTP response body. As a result, arbitrary scripts injected by an attacker are interpreted and executed by the victim's browser.\nExploitation of this vulnerability requires no authentication or special privileges, making it accessible to any unauthenticated network-adjacent or remote attacker capable of interacting with the vulnerable endpoints of Agrion <= 1.0.0. The attack flow typically begins with the adversary crafting a malicious URL containing JavaScript payloads embedded within vulnerable input parameters. The attacker then delivers this payload to the target victim via social engineering, phishing, or direct link manipulation.\nWhen the victim accesses the maliciously crafted URL, the vulnerable Agrion component processes the input and reflects the payload back into the HTTP response without applying appropriate output encoding such as HTML entity encoding. The victim's web browser parses the response, interprets the injected payload as legitimate executable script code, and executes it within the security context of the victim's session.\nThe behavior of the payload can vary depending on the attacker's objectives, ranging from capturing session cookies and LocalStorage tokens to performing unauthorized API requests on behalf of the authenticated user. Post-exploitation impact includes complete session compromise, unauthorized access to sensitive application features, and potential defacement or manipulation of the rendered web interface."
}