{"data":{"id":"cb31bc5f-f308-4d7f-9103-22d08da84ece","title":"CVE-2024-25639: Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately…","summary":"CVE-2024-25639 affects the Khoj Obsidian, Desktop and Web clients, which inadequately sanitize the AI model's response and user inputs. Untrusted documents, whether indexed by the user or read from the internet via the /online command, can trigger Cross Site Scripting (XSS) through Prompt Injection.","solution":"Fixed in 1.13.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-25639","publishedAt":"2024-07-08T15:15:21.423Z","cveId":"CVE-2024-25639","cweIds":["CWE-80","CWE-77","CWE-79"],"cvssScore":"5.9","cvssSeverity":"medium","severity":"medium","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Khoj"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Khoj cross-site scripting via prompt injection from untrusted documents","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00573,"epssCheckedAt":"2026-11-04T18:09:13.251Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-29T00:11:24.970Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-198","CAPEC-86","CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[]}}