← All advisories

Medium severity6.1NVD Advisory· Published Nov 18, 2025· Updated Jun 17, 2026

CVE-2025-56526

CVE-2025-56526

Description

Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3

Cinnamon/Kotaemon2 versions
cpe:2.3:a:cinnamon:kotaemon:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:cinnamon:kotaemon:*:*:*:*:*:*:*:*range: <=0.11.0
- (no CPE)range: <0.11.0
Kotaemon/Kotaemondescription

Patches

Vulnerability mechanics

References

3

github.com/Cinnamon/kotaemon/commit/37cdc28nvdPatch
harvest-sink-590.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-236770c3fe1e80f6a1aef381fb1c8f73nvdExploitThird Party Advisory
skinny-exoplanet-584.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-22cd1563bd3380458588eb49f361a363nvdExploitThird Party Advisory

News mentions

0

No linked articles in our index yet.