https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 12:35:11 +0000 https://vulnerability.circl.lu/vuln/cve-2024-43396 <p><strong>Affected:</strong> khoj-ai khoj</p> <p>Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.</p> <p><strong>Affected:</strong> khoj-ai khoj</p> <p>Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.</p> https://vulnerability.circl.lu/vuln/cve-2024-43396 https://vulnerability.circl.lu/vuln/pysec-2026-1492 <p><strong>Affected:</strong> PyPI: khoj</p> <p>### Summary The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS.</p> <p>### Details The `q` parameter for the `/api/automation` endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS.</p> <p>### PoC ``` POST /api/automation?q=%22%3E%3C%2Ftextarea%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E%3Cscript%3Ealert(2)%3C%2Fscript%3E ```</p> <p>### Impact Stored XSS: </p> <p>### Fix - Added a Content Security Policy to all config pages on the web client, including the automation page - Used DOM scripting to construct all components on the config pages, including the automation page</p> <p><strong>Affected:</strong> PyPI: khoj</p> <p>### Summary The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS.</p> <p>### Details The `q` parameter for the `/api/automation` endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS.</p> <p>### PoC ``` POST /api/automation?q=%22%3E%3C%2Ftextarea%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E%3Cscript%3Ealert(2)%3C%2Fscript%3E ```</p> <p>### Impact Stored XSS: </p> <p>### Fix - Added a Content Security Policy to all config pages on the web client, including the automation page - Used DOM scripting to construct all components on the config pages, including the automation page</p> https://vulnerability.circl.lu/vuln/pysec-2026-1492