Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

khoj-assistant

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3PyPIAmendedPublished

    Khoj Open Redirect Vulnerability in Login Page

    GHSA-564j-v29w-rqr6

    Affected
    • PyPI khoj-assistant < 1.14.0
    Fixed in
    1.14.0· Vendor fix available
    Issue
    An attacker can use the next parameter on the login page to redirect a victim to a malicious page, while masking this using a legit-looking app.khoj.dev url. For example, https://app.khoj.dev/login?next=//example.com will redirect to the https://example.com page. Details The problem seems to be in this method: https://github.com/khoj-ai/khoj/blob/2667ef45449eb408ce1d7c393be04845be31e15f/src/khoj/routers/auth.py#L95 PoC Open the https://app.khoj.dev/login?next=//example.com url in a Gecko-based browser (Firefox). Impact The impact is low, and this could only be used in phishing attempts, but it's still a problem nonetheless.

    Recommended action: Upgrade to 1.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →