VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Jul 8, 2024· Updated Jun 17, 2026

CVE-2024-25639

CVE-2024-25639

Description

Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command. This vulnerability is fixed in 1.13.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Khoj/Khoj
    cpe:2.3:a:khoj:khoj:*:*:*:*:*:*:*:*
    Range: <1.13.0
  • Khoj AI/Khojllm-fuzzy2 versions
    >=1.13.0+ 1 more
    • (no CPE)range: >=1.13.0
    • (no CPE)range: < 1.13.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.