CVE-2024-43396

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.

• CWE-79
• CWE-79

• https://github.com/khoj-ai/khoj/commit/1c7a562880eeb7354325545d2cf6c5d1d1134812Patch
• https://github.com/khoj-ai/khoj/commit/55be90cdd2f9d6a09c8bf9ceea52fc36b9201626Patch
• https://github.com/khoj-ai/khoj/security/advisories/GHSA-cf72-vg59-4j4hExploit, Vendor Advisory

Published

Aug 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43390A low privileged remote attacker can perform configuration c…8.1
• CVE-2024-43391A low privileged remote attacker can perform configuration c…8.1
• CVE-2024-43392A low privileged remote attacker can perform configuration c…8.1
• CVE-2024-43393A low privileged remote attacker can perform configuration c…8.1
• CVE-2024-43394Server-Side Request Forgery (SSRF) in Apache HTTP Server on …7.5
• CVE-2024-43395CraftOS-PC 2 is a rewrite of the desktop port of CraftOS fro…8.2
• CVE-2024-43397Apollo is a configuration management system. A vulnerability…4.3
• CVE-2024-43398REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6…5.9
• CVE-2024-43399Mobile Security Framework (MobSF) is a pen-testing, malware …9.8
• CVE-2024-4340Passing a heavily nested list to sqlparse.parse() leads to a…7.5
• CVE-2024-43400XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2024-43401XWiki Platform is a generic wiki platform offering runtime s…8