CVE-2023-30959: Stored XSS via javascript URI in Apollo Change Requests comment

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-27 · updated 2026-06-17
Weakness: CWE-84

Description

In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.

Affected products

Palantir com.palantir.apollo:autopilot: before 3.308.0 — fixed in 3.308.0

How to fix

Upgrade to a fixed version: Palantir com.palantir.apollo:autopilot 3.308.0. Check the vendor advisory for mitigations.

References

https://palantir.safebase.us/?tcuUid=4c257f07-58af-4532-892a-bdbe8ab3ec63
https://palantir.safebase.us/?tcuUid=4c257f07-58af-4532-892a-bdbe8ab3ec63

Get alerted when CVE-2023-30959 or the next vulnerability affects your stack