Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)
Medium5.4CVE-2024-43396 · Published Aug 20, 2024 · updated Jul 7, 2026
### Summary The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. ### Details The `q` parameter for the `/api/automation` endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. ### PoC ``` POST /api/automation?q=%22%3E%3C%2Ftextarea%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E%3Cscript%3Ealert(2)%3C%2Fscript%3E ``` ### Impact Stored XSS:  ### Fix - Added a Content Security Policy to all config pages on the web client, including the automation page - Used DOM scripting to construct all components on the config pages, including the automation page
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| khoj PyPI | < 1.15.0 | 1.15.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2024-43396, PYSEC-2026-1492
More Khoj advisories
All Khoj| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 25 | khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem HighSep 25 | High | 2.0.0-beta.25 |
| Feb 2 | Khoj has an IDOR in Notion OAuth Flow that Enables Index PoisoningMedium5.4Feb 2 | Medium5.4 | No fix yet |
| Dec 302024 | khoj has an IDOR in subscription management allows unauthorized subscription modificationsMedium4.3Dec 30, 2024 | Medium4.3 | 1.29.0 |