CVE-2024-2171

Advisory

A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://huntr.com/bounties/cee06a28-7e3b-460b-b504-69add838ebe8
• https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e
• https://github.com/advisories/GHSA-vwgf-7f9h-h499
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2171