CVE-2024-6229: Stored XSS in stangirard/quivr

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-07-07 · updated 2026-06-17
Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr, affecting the latest version. Users can upload files via URL, which allows the insertion of malicious JavaScript payloads. These payloads are stored on the server and executed whenever any user clicks on a link containing the payload, leading to potential data theft, session hijacking, and reputation damage.

Affected products

stangirard/quivr: through 0.0.281

References

https://huntr.com/bounties/2ee71e9e-2cf5-41a4-8440-d75758018786
https://huntr.com/bounties/2ee71e9e-2cf5-41a4-8440-d75758018786

Get alerted when CVE-2024-6229 or the next vulnerability affects your stack