-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper output encoding when rendering user-controlled input in the automation configuration interface. The original implementation in generateAutomationRow used innerHTML with template literals containing unsanitized values from the automation object (automation.subject, automation.crontime, automation.query_to_run). This allowed attackers to inject arbitrary HTML/JS via the 'q' parameter, which was reflected in the rendered page. The commit 1c7a562 fixed this by switching to DOM scripting methods (createElement/textContent) that inherently prevent XSS through proper context-aware escaping. The presence of innerHTML with user-controlled data in the pre-patch code matches the XSS vulnerability described in CVE-2024-43396.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| khoj | pip | < 1.15.0 | 1.15.0 |
PythonPythonOngoing coverage of React2Shell