Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The /home/{filepath:path} endpoint in webclient.py serves static files by directly concatenating the user-supplied filepath with the homedirectory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequences to read arbitrary files from the server filesystem. Details Vulnerable code — src/khoj/routers/webclient.py lines 46-49: Where homedirectory is defined in src/khoj/utils/constants.py line 6: What is missing: - No .. traversal filtering - No path normalization/resolution check (e.g., resolved.isrelativeto(homedirectory)) - No authentication decorator (@requires(["authenticated"]) is absent) - Starlette's FileResponse does NOT perform path traversal protection Path resolution: PoC URL-encoded variant (may bypass some reverse proxy normalization): Impact Unauthenticated arbitrary file read. An attacker with network access to the Khoj instance can: - Read application configuration — Django…
Recommended action: Upgrade to 2.0.0b25 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An Insecure Direct Object Reference (IDOR) vulnerability in the updatesubscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request. Details The vulnerability exists in the subscription endpoint at /api/subscription. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription. Vulnerable code in /api/subscription: PoC 1. Create a customer account in stripe: - Customer A: adventure8812@zeropath.com (attacker) 2. Log in as any user. 3. Send this request: 4. The subscription for Customer A is successfully set to cancel. Impact High: Revenue loss via mass cancellation of subscriptions. Loss of customer trust by re-enabling subscriptions they had set to cancel. Resolution This was fixed in the…
Recommended action: Upgrade to 1.29.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. Details The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. PoC Impact Stored XSS: Fix - Added a Content Security Policy to all config pages on the web client, including the automation page - Used DOM scripting to construct all components on the config pages, including the automation page
Recommended action: Upgrade to 1.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.