CVE-2024-25639
Medium
Description
Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command. This vulnerability is fixed in 1.13.0.
SeverityMedium
CVSS5.9
Exploit probability—
ProductKhoj
PublishedJul 8, 2024
First seenJul 8, 2024
Weakness typeCWE-80CWE-80
How to fix
Update
- khoj khoj1.13.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| khoj khoj | v < 1.13.0 | 1.13.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.