PT-2025-12106 · Serge · Serge

Published 2025-03-20 · Updated 2025-03-22 · CVE-2024-11441

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Serge version 0.9.0

Description A stored cross-site scripting (XSS) issue exists due to improper neutralization of input during web page generation in the chat prompt. An attacker can exploit this by sending a crafted message containing malicious HTML/JavaScript code, which will be stored and executed whenever the chat is accessed, leading to unintended content being shown to the user and potential phishing attacks.

Recommendations For Serge version 0.9.0, update to a version that properly neutralizes input during web page generation to prevent the storage and execution of malicious code. As a temporary workaround, consider restricting the use of the chat prompt feature until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-11441

Affected Products

Serge

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-11441 · Security Note
• https://twitter.com/CVEnew/status/1903336857594892644 · Twitter Post
• https://huntr.com/bounties/ae76d1ea-21a4-456d-bef2-331aef3ea376 · Note