CVE-2024-43396

Published: 2024-08-20T21:15Z

Last Modified: 2024-09-03T18:19Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt