CVE-2024-41943

I, Librarian is an open-source version of a PDF managing SaaS. PDF notes are displayed on the Item Summary page without any form of validation or sanitation. An attacker can exploit this vulnerability by inserting a payload in the PDF notes that contains malicious code or script. This code will then be executed when the page is loaded in the browser. The vulnerability was fixed in version 5.11.1.

• CWE-79

• https://github.com/mkucej/i-librarian-free/commit/b4570103d21fc4fdd2483689aafc6028d9f6a76d
• https://github.com/mkucej/i-librarian-free/security/advisories/GHSA-h5hx-fm7f-2xmx
• https://github.com/mkucej/i-librarian-free/commit/b4570103d21fc4fdd2483689aafc6028d9f6a76d
• https://github.com/mkucej/i-librarian-free/security/advisories/GHSA-h5hx-fm7f-2xmx

Published

Jul 30, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41938A vulnerability has been identified in SINEC NMS (All versio…3.8
• CVE-2024-41939A vulnerability has been identified in SINEC NMS (All versio…8.8
• CVE-2024-4194The The Album and Image Gallery plus Lightbox plugin for Wor…7.3
• CVE-2024-41940A vulnerability has been identified in SINEC NMS (All versio…9.1
• CVE-2024-41941A vulnerability has been identified in SINEC NMS (All versio…4.3
• CVE-2024-41942JupyterHub is software that allows one to create a multi-use…7.2
• CVE-2024-41944Xibo is a content management system (CMS). An SQL injection …6.5
• CVE-2024-41945fuels-ts is a library for interacting with Fuel v2. The typ…3.1
• CVE-2024-41946REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a …7.5
• CVE-2024-41947XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2024-41948biscuit-java is the java implementation of Biscuit, an authe…5
• CVE-2024-41949biscuit-rust is the Rust implementation of Biscuit, an authe…6.4