CVE-2024-43396Medium· 5.4▾ Sunlit

Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score30/ 100 · Low

impact 29.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 20, 2024

Updated

Jul 7, 2026

CVSS

5.4

Vendor

khoj

Product

khoj

CWE

—

Depth score

30 · Low

EPSS

0.55% · p45

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 8.

0.5% → 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 708 days

Aug 20, 2024Published
Disclosed via OSV
Jul 7, 2026Record revised
Last analysed / modified upstream
Jul 8, 2026EPSS first tracked
0.5%
Jul 29, 2026EPSS peak
0.5% → 0.5%

khoj #osv #pip

Affected

khoj < 1.15.0

Patched in

khoj 1.15.0

Full technical detail▾

Overview

Summary

The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS.

Details

The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS.

PoC

POST /api/automation?q=%22%3E%3C%2Ftextarea%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E%3Cscript%3Ealert(2)%3C%2Fscript%3E

Impact

Stored XSS:

Fix

Added a Content Security Policy to all config pages on the web client, including the automation page
Used DOM scripting to construct all components on the config pages, including the automation page

Affected packages

khoj < 1.15.0

Remediation

Upgrade to a patched release:

khoj 1.15.0

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#pip