CVE-2024-9107mediumCWE-79

CVE-2024-9107: medium-severity vulnerability in gaizhenbiao/chuanhuchatgpt

Stored XSS in gaizhenbiao/chuanhuchatgpt

Published

Follow this CVE+ Monitor gaizhenbiao/chuanhuchatgpt+ Monitor chuanhuchatgpt

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.6%
A stored cross-site scripting (XSS) vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, affecting version git 20b2e02. The vulnerability arises from improper sanitization of HTML tags in chat history uploads. Specifically, the sanitization logic fails to handle HTML tags within code blocks correctly, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially leading to identity theft or other malicious actions.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected products
gaizhenbiao · gaizhenbiao/chuanhuchatgpt
Related CVEs — gaizhenbiao/chuanhuchatgpt

In the same product, most dangerous first.

CVE-2024-5982CRITICALPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 31.3%CVE-2024-6255HIGHPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 13.7%CVE-2024-6036HIGHDenial of Service in gaizhenbiao/chuanhuchatgptEPSS 10.8%CVE-2024-6037HIGHArbitrary Folder Creation in gaizhenbiao/chuanhuchatgptEPSS 10.7%CVE-2024-3234CRITICALPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 3.8%CVE-2024-5124HIGHTiming Attack Vulnerability in gaizhenbiao/chuanhuchatgptEPSS 1.4%