PT-2024-30556 · Khoj · Khoj

Calligraf0 · CVE-2024-43396 · Published 2024-08-20 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Khoj versions prior to 1.15.0

Description The Automation feature in Khoj allows users to insert arbitrary HTML inside task instructions, resulting in a Stored XSS. The q parameter for the "/api/automation" endpoint does not get correctly sanitized when rendered on the page, allowing users to inject arbitrary HTML/JS.

Recommendations For versions prior to 1.15.0, update to version 1.15.0 to fix the vulnerability. As a temporary workaround, consider restricting access to the /api/automation endpoint until the update is applied. Additionally, avoid using the q parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-43396

GHSA-CF72-VG59-4J4H

PYSEC-2026-1492

Affected Products

Khoj

References · 14

• 🔥 https://github.com/khoj-ai/khoj/security/advisories/GHSA-cf72-vg59-4j4h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43396.json · Exploit
• https://github.com/khoj-ai/khoj/commit/1c7a562880eeb7354325545d2cf6c5d1d1134812 · Patch
• https://github.com/khoj-ai/khoj/commit/55be90cdd2f9d6a09c8bf9ceea52fc36b9201626 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-43396 · Security Note
• https://osv.dev/vulnerability/CVE-2024-43396 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cf72-vg59-4j4h · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1492 · Vendor Advisory
• https://github.com/khoj-ai/khoj · Note
• https://t.me/cvedetector/3688 · Telegram Post
• https://pypi.org/project/khoj · Note
• https://twitter.com/VulmonFeeds/status/1826027747220640019 · Twitter Post
• https://twitter.com/CVEnew/status/1825995685738721397 · Twitter Post
• https://github.com/advisories/GHSA-cf72-vg59-4j4h · Note