CVE-2024-51498

cobalt is a media downloader that doesn't piss you off. A malicious cobalt instance could serve links with the `javascript:` protocol, resulting in Cross-site Scripting (XSS) when the user tries to download an item from a picker. This issue has been present since commit `66bac03e`, was mitigated in commit `97977efa` (correctly configured web instances were no longer vulnerable) and fully fixed in commit `c4be1d3a` (included in release version 10.2.1). Users are advised to upgrade. Users unable to upgrade should enable a content-security-policy.

• CWE-79

• https://github.com/imputnet/cobalt/commit/66bac03e3078e4e781d2d3903c05ad66a883a354
• https://github.com/imputnet/cobalt/commit/97977efabd92375f270d1818f38de3b0682c2f19
• https://github.com/imputnet/cobalt/commit/c4be1d3a37b0deb6b6087ec7a815262ac942daf1
• https://github.com/imputnet/cobalt/security/advisories/GHSA-cm4c-v4cm-3735

Published

Nov 5, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-51492Zusam is a free and open-source way to self-host private for…8.8
• CVE-2024-51493OctoPrint provides a web interface for controlling consumer …6.5
• CVE-2024-51494LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-51495LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-51496LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-51497LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-51499MarkUs is a web application for the submission and grading o…8.8
• CVE-2024-5150The Login with phone number plugin for WordPress is vulnerab…9.8
• CVE-2024-51500Meshtastic firmware is a device firmware for the Meshtastic …7.5
• CVE-2024-51501Refit is an automatic type-safe REST library for .NET Core, …10
• CVE-2024-51502loona is an experimental, HTTP/1.1 and HTTP/2 implementation…5.1
• CVE-2024-51503A security agent manual scan command injection vulnerability…8.8