CVE-2024-43396

Advisory

Affected versions of Khoj contain a vulnerability in the Automation feature that allows users to inject arbitrary HTML or JavaScript, leading to Stored Cross-site Scripting (XSS) attacks. This issue occurs because the q parameter in the /api/automation endpoint was not properly sanitized when rendered on the page.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/khoj-ai/khoj/commit/55be90cdd2f9d6a09c8bf9ceea52fc36b9201626
• https://github.com/khoj-ai/khoj/commit/1c7a562880eeb7354325545d2cf6c5d1d1134812
• https://github.com/advisories/GHSA-cf72-vg59-4j4h
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43396