CVE-2026-14933 (GCVE-0-2026-14933)
Vulnerability from cvelistv5
Published
2026-10-20 11:08
Modified
2026-10-20 15:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.
The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.
Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unblu inc. | Unblu Spark |
Version: 7.0 ≤ 7.57.7 Version: 8.0 ≤ 8.39.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14933",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:28:00.378931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:28:15.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThan": "8.35.2",
"status": "unaffected",
"version": "8.35.2-hotfix.0",
"versionType": "semver"
},
{
"lessThan": "8.37.2",
"status": "unaffected",
"version": "8.37.2-hotfix.2",
"versionType": "semver"
},
{
"lessThan": "8.38.2",
"status": "unaffected",
"version": "8.38.2-hotfix.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.57.7",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.39.2",
"status": "affected",
"version": "8.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.39.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker\u0027s co-browsing session, via content of the co-browsed page that the agent\u0027s browser renders as HTML.\u003c/p\u003e\u003cp\u003eThe JavaScript runs in the context and under the identity of the agent\u0027s session in the Agent Desk or the Single Conversation Desk.\u003c/p\u003e\u003cp\u003eExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn\u0027t affected.\u003c/p\u003e"
}
],
"value": "Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker\u0027s co-browsing session, via content of the co-browsed page that the agent\u0027s browser renders as HTML.\n\n\n\nThe JavaScript runs in the context and under the identity of the agent\u0027s session in the Agent Desk or the Single Conversation Desk.\n\n\n\nExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn\u0027t affected."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:08:43.830Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-004"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later. The fix is also available in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these release lines.\u003c/p\u003e\u003cp\u003eUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\u003c/p\u003e\u003cp\u003eFor a workaround for on-premises deployments that can\u0027t be upgraded immediately, see the security bulletin.\u003c/p\u003e"
}
],
"value": "Upgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later. The fix is also available in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these release lines.\n\n\n\nUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\n\n\n\nFor a workaround for on-premises deployments that can\u0027t be upgraded immediately, see the security bulletin."
}
],
"source": {
"advisory": "UBL-2026-004",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Cross-Site Scripting in Embedded Co-Browsing",
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-14933",
"datePublished": "2026-10-20T11:08:43.830Z",
"dateReserved": "2026-07-07T10:56:24.163Z",
"dateUpdated": "2026-10-20T15:28:15.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-14933\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-20T15:28:00.378931Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-20T15:28:10.344Z\"}}], \"cna\": {\"title\": \"Unblu Spark Cross-Site Scripting in Embedded Co-Browsing\", \"source\": {\"advisory\": \"UBL-2026-004\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Kenan Karalioglu (chef_shell) via YesWeHack\"}], \"impacts\": [{\"capecId\": \"CAPEC-588\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-588 DOM-Based XSS\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.6, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Unblu inc.\", \"product\": \"Unblu Spark\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"8.35.2-hotfix.0\", \"lessThan\": \"8.35.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"8.37.2-hotfix.2\", \"lessThan\": \"8.37.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"8.38.2-hotfix.0\", \"lessThan\": \"8.38.2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.57.7\"}, {\"status\": \"affected\", \"version\": \"8.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.39.2\"}, {\"status\": \"unaffected\", \"version\": \"8.39.3\"}], \"platforms\": [\"On-premises\", \"Cloud\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later. The fix is also available in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these release lines.\\n\\n\\n\\nUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\\n\\n\\n\\nFor a workaround for on-premises deployments that can\u0027t be upgraded immediately, see the security bulletin.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eUpgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later. The fix is also available in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these release lines.\u003c/p\u003e\u003cp\u003eUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\u003c/p\u003e\u003cp\u003eFor a workaround for on-premises deployments that can\u0027t be upgraded immediately, see the security bulletin.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://docs.unblu.com/latest/security-bulletins/#UBL-2026-004\", \"name\": \"Unblu Security Advisories\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"manual\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker\u0027s co-browsing session, via content of the co-browsed page that the agent\u0027s browser renders as HTML.\\n\\n\\n\\nThe JavaScript runs in the context and under the identity of the agent\u0027s session in the Agent Desk or the Single Conversation Desk.\\n\\n\\n\\nExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn\u0027t affected.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eCross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker\u0027s co-browsing session, via content of the co-browsed page that the agent\u0027s browser renders as HTML.\u003c/p\u003e\u003cp\u003eThe JavaScript runs in the context and under the identity of the agent\u0027s session in the Agent Desk or the Single Conversation Desk.\u003c/p\u003e\u003cp\u003eExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn\u0027t affected.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"455daabc-a392-441d-aa46-37d35189897c\", \"shortName\": \"NCSC.ch\", \"dateUpdated\": \"2026-10-20T11:08:43.830Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-14933\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-20T15:28:15.051Z\", \"dateReserved\": \"2026-07-07T10:56:24.163Z\", \"assignerOrgId\": \"455daabc-a392-441d-aa46-37d35189897c\", \"datePublished\": \"2026-10-20T11:08:43.830Z\", \"assignerShortName\": \"NCSC.ch\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…