CVE-2026-108725: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cheshire-cat-ai core

Cheshire Cat AI core through version 2.0.23 contains a stored cross-site scripting vulnerability in its uploads plugin. Authenticated users can upload HTML files via POST /uploads without any type restrictions. This allows an attacker to craft a public GET /uploads/{path} URL that, when visited by a signed-in victim, executes malicious scripts in the context of the application origin. The script runs with the victim's access_token cookie, which may include administrator privileges, enabling potential session hijacking or other attacks leveraging the victim's authenticated session.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the vulnerable application for signed-in users, including administrators. This can lead to session hijacking via access_token cookie theft and unauthorized actions performed with the victim's privileges. The vulnerability requires authentication and user interaction (clicking a malicious link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and avoid clicking on suspicious URLs related to uploads. Implement additional input validation and content-type restrictions on uploaded files if possible.