Upgrade AlmaLinux:9 kernel-64k-debug-devel-matched to version 0:5.14.0-427.37.1.el9_4 or higher. This issue was patched in ALSA-2024:6997 .

khoj-assistant@0.7.2.dev20 vulnerabilities

khoj-assistant is now khoj

latest version

1.21.1.dev5

latest non vulnerable version

1.21.1.dev5

first published

2 years ago

latest version published

6 months ago

licenses detected

GPL-3.0
[0.1.0,1.7.1.dev48)

View khoj-assistant package health on Snyk Advisor (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the khoj-assistant package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
L Cross-site Scripting (XSS) khoj-assistant is an An AI copilot for your Second Brain Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via prompt injection, due to accepting unsanitized input in the Obsidian, Desktop, and Web clients. An attacker who can convince a user to index a malicious page or read a page containing malicious instructions or prompts via the `/online` command can cause script execution on the user's system. This can effect undesired output from the user's application, exposure of sensitive information stored in the client, or interruption to the user's session. How to fix Cross-site Scripting (XSS)? Upgrade `khoj-assistant` to version 1.13.0 or higher.	[,1.13.0)
M Open Redirect khoj-assistant is an An AI copilot for your Second Brain Affected versions of this package are vulnerable to Open Redirect through the `next` parameter on the login page. An attacker can redirect a victim to a malicious site by manipulating the URL parameter to point to an undesirable destination. How to fix Open Redirect? Upgrade `khoj-assistant` to version 1.14.0 or higher.	[,1.14.0)

Cross-site Scripting (XSS)

khoj-assistant is an An AI copilot for your Second Brain

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via prompt injection, due to accepting unsanitized input in the Obsidian, Desktop, and Web clients. An attacker who can convince a user to index a malicious page or read a page containing malicious instructions or prompts via the /online command can cause script execution on the user's system. This can effect undesired output from the user's application, exposure of sensitive information stored in the client, or interruption to the user's session.

How to fix Cross-site Scripting (XSS)?

Upgrade khoj-assistant to version 1.13.0 or higher.

[,1.13.0)

Open Redirect

khoj-assistant is an An AI copilot for your Second Brain

Affected versions of this package are vulnerable to Open Redirect through the next parameter on the login page. An attacker can redirect a victim to a malicious site by manipulating the URL parameter to point to an undesirable destination.

How to fix Open Redirect?

Upgrade khoj-assistant to version 1.14.0 or higher.

[,1.14.0)

Go back to all versions of this package