{"data":{"id":"ed5aaaa3-57f0-4a5d-84bb-eeaa7da97be6","title":"CVE-2024-43396: Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML…","summary":"CVE-2024-43396 affects Khoj, an application that creates personal AI agents. The Automation feature does not sanitize the q parameter for the /api/automation endpoint when it is rendered on the page, so a user can inject arbitrary HTML and JavaScript, resulting in Stored XSS (CWE-79).","solution":"This vulnerability is fixed in 1.15.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-43396","publishedAt":"2024-08-20T21:15:14.897Z","cveId":"CVE-2024-43396","cweIds":["CWE-79","CWE-79"],"cvssScore":"5.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["khoj@< 1.15.0 (fixed: 1.15.0)"],"affectedPackageNames":["khoj"],"affectedPackageRefs":["pypi:khoj"],"affectedVendors":[],"affectedVendorsRaw":["Khoj"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Khoj stored XSS through Automation feature task instructions","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0055,"epssCheckedAt":"2026-11-04T00:12:27.299Z","kevDateAdded":null,"advisoryAliases":["GHSA-cf72-vg59-4j4h"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:22.027Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:45:35.881Z","capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"khoj","fixedVersion":"1.15.0","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"registry","status":"version_not_found","checkedAt":"2026-10-29T21:45:35.727Z"}]}}