{"data":{"id":"59f6fd4f-de29-4d09-8905-7457e43c7c10","title":"CVE-2024-6706: Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the…","summary":"CVE-2024-6706 is a vulnerability in which attackers craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page. It is classified as CWE-79, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), and was published by NVD on 08/07/2024 with the source listed as KoreLogic.","solution":"N/A -- no mitigation discussed in source.","labels":["security","safety"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-6706","publishedAt":"2024-08-07T23:15:41.350Z","cveId":"CVE-2024-6706","cweIds":["CWE-79","CWE-79"],"cvssScore":"6.1","cvssSeverity":"medium","severity":"medium","attackType":["jailbreak","other"],"issueType":"vulnerability","affectedPackages":["open-webui@<= 0.1.105"],"affectedPackageNames":["open-webui"],"affectedPackageRefs":["pypi:open-webui"],"affectedVendors":[],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Language model prompt injection enabling cross-site scripting in web page","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00657,"epssCheckedAt":"2026-11-04T06:10:15.237Z","kevDateAdded":null,"advisoryAliases":["GHSA-5jp3-wp5v-5363"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:24.460Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","safety"],"aiComponentTargeted":"model","llmSpecific":true,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":["AML.T0054"],"fixes":[]}}