Description

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.

INFO

Published Date :

2024-08-20T20:23:05.660Z

Last Modified :

2024-08-21T19:52:35.357Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-43396 vulnerability.

Vendors Products
Khoj
  • Khoj
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-43396.

URL Resource
https://github.com/khoj-ai/khoj/commit/1c7a562880eeb7354325545d2cf6c5d1d1134812 cve-icon cve-icon
https://github.com/khoj-ai/khoj/commit/55be90cdd2f9d6a09c8bf9ceea52fc36b9201626 cve-icon cve-icon
https://github.com/khoj-ai/khoj/security/advisories/GHSA-cf72-vg59-4j4h cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact