CVE-2024-43396CWE-79

Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)

Medium · published August 20, 2024

CVSS v3.1
5.4
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-08-20T20:23Z
EPSS history
Timeline
  • 20 AUG 20:23Z
    Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)
    cvelistv5