Advisoriesby IbisKhojGHSA-cf72-vg59-4j4h
Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)
Fix: upgrade to 1.15.0 or later
Summary
The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS.
Details
The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS.
PoC
`
POST /api/automation?q=%22%3E%3C%2Ftextarea%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E%3Cscript%3Ealert(2)%3C%2Fscript%3E
`
Impact
Stored XSS:
Fix
- Added a Content Security Policy to all config pages on the web client, including the automation page
- Used DOM scripting to construct all components on the config pages, including the automation page
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| khoj PyPI | < 1.15.0 | 1.15.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2024-43396, PYSEC-2026-1492
More Khoj advisories
All Khoj
khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystemGHSA-62mm-xwmv-crhgfixed in 2.0.0-beta.25Khoj has an IDOR in Notion OAuth Flow that Enables Index PoisoningCVE-2025-69207no fix yetkhoj has an IDOR in subscription management allows unauthorized subscription modificationsCVE-2024-52294fixed in 1.29.0