SecuriTricks - CVE-2024-25639

Description

Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command. This vulnerability is fixed in 1.13.0.

Product(s) Impacted

Product	Versions
Khoj Obsidian	before 1.13.0
Khoj Desktop	before 1.13.0
Khoj Web clients	before 1.13.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References

https://github.com/khoj-ai/khoj/commit/1dfd6d7391862d3564db7f4875216880b73cb6cc

https://github.com/khoj-ai/khoj/security/advisories/GHSA-h2q2-vch3-72qm

CVSS Score

5.9 / 10

CVSS Data

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: NONE
Availability Impact: LOW

View Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L

Date

Published: July 8, 2024, 3:15 p.m.
Last Modified: July 8, 2024, 3:49 p.m.

Status : Undergoing Analysis

CVE is currently being analyzed by NVD staff, this process results in association of reference link tags, CVSS scores, CWE association, and CPE applicability statements.

More info

Source

security-advisories@github.com

CVE-2024-25639