Open Redirect Affecting khoj-assistant package, versions [,1.14.0)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Open Redirect vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-PYTHON-KHOJASSISTANT-7430920
published9 Jul 2024
disclosed8 Jul 2024
creditDavid Bors

Report a new vulnerability Found a mistake?

Introduced: 8 Jul 2024

CWE-601 (opens in a new tab)

How to fix?

Upgrade khoj-assistant to version 1.14.0 or higher.

Overview

khoj-assistant is an An AI copilot for your Second Brain

Affected versions of this package are vulnerable to Open Redirect through the next parameter on the login page. An attacker can redirect a victim to a malicious site by manipulating the URL parameter to point to an undesirable destination.

References

CVSS Scores

version 4.0

version 3.1

Attack Vector (AV)
Network
Attack Complexity (AC)
Low
Attack Requirements (AT)
None
Privileges Required (PR)
None
User Interaction (UI)
All

Confidentiality (VC)
None
Integrity (VI)
High
Availability (VA)
None

Confidentiality (SC)
None
Integrity (SI)
None
Availability (SA)
None