CVE-2024-43396: Khoj

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.

Affected products

• Khoj Khoj: before 1.15.0 (fixed in 1.15.0)

Published 2024-08-20. Last modified 2026-06-17.