CVE-2026-14933: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Unblu inc. Unblu Spark

This vulnerability arises from improper neutralization of input during web page generation (CWE-79) in the embedded co-browsing feature of Unblu Spark. An attacker acting as a visitor can inject malicious JavaScript that executes in the context of the agent's browser session within the Agent Desk or Single Conversation Desk interfaces. The vulnerability affects versions 7.0 up to and including 7.57.7 and 8.0 up to and including 8.39.2. Exploitation requires user interaction in the form of an agent joining the attacker's co-browsing session. The vulnerability does not impact mobile co-browsing.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the agent's browser session, potentially leading to session hijacking, unauthorized actions, or data exposure within the agent's context. The attack requires the agent to join the co-browsing session initiated by the attacker, limiting the attack vector to scenarios involving agent participation. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting agent participation in untrusted co-browsing sessions and monitoring co-browsing usage. Since mobile co-browsing is not affected, using mobile clients may reduce risk in some scenarios.