PT-2025-23513 · Electron+2 · Electron+2

Published 2025-06-02 · Updated 2025-06-07 · CVE-2024-57783

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dot versions 0.9.3 and earlier

Description The issue allows for XSS and resultant command execution. This is because user input and LLM output are appended to the DOM with innerHTML, specifically in render.js. Additionally, the Electron window can access Node.js APIs, contributing to the problem. No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations For Dot versions 0.9.3 and earlier, consider disabling the render.js function temporarily to mitigate the risk of exploitation. Restrict access to the Electron window's ability to access Node.js APIs to minimize the risk of command execution. Avoid using the innerHTML method in the DOM until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-57783

Affected Products

Dot

Electron

Node.Js

References · 7

• 🔥 https://github.com/EDMPL/Vulnerability-Research/tree/main/CVE-2024-57783 · Exploit
• https://osv.dev/vulnerability/CVE-2024-57783 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57783 · Security Note
• https://github.com/alexpinel/Dot/issues/28 · Note
• https://twitter.com/cracbot/status/1931305198368022551 · Twitter Post
• https://t.me/cvenotify/124345 · Telegram Post
• https://dotapp.uk · Note