CVE-2026-14933 Details
Description
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk. Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
A cross-site scripting vulnerability has been identified in the embedded co-browsing feature of Unblu Spark versions 7.0 through 7.57.7 and 8.0 through 8.39.2, in both on-premises and cloud deployments. This vulnerability allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent participating in the co-browsing session. The exploitation is achieved by manipulating the content of the co-browsed page, which is rendered as HTML in the agent's browser. The injected JavaScript executes within the context of the agent's session in the Agent Desk or the Single Conversation Desk. To exploit this vulnerability, an agent must join a co-browsing session with the attacker.
Unblu Cloud customers do not need to take any action, as the fix is already deployed. For on-premises deployments, upgrade to Unblu Spark versions 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0, 8.39.3 or Unblu Spark 7.57.9. If an immediate upgrade is not possible, embedded co-browsing can be disabled by setting 'com.unblu.messenger.embeddedCoBrowsingEnabled' to 'false'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.unblu.com/latest/security-bulletins/#UBL-2026-004 | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Unblu Spark | >= 8, <= 8.39.2 >= 7, <= 7.57.7 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |