CVE-2024-0435

    Dashboard / Vulnerabilities / CVE-2024-0435

    CVE-2024-0435

    Published: 25 Feb 2024Last Modified: 12 Aug 2026

    Summary: User can submit message to self-XSS

    Details: User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the minimum requirement for a user to send a chat is to be given access to a workspace via an admin the risk is low. Additionally, the location in which the XSS renders is only limited to the user who submits the XSS. Ultimately, this attack is limited to the user attacking themselves. There is no anonymous chat submission unless the user does not take the minimum steps required to protect their instance.

    References: https://huntr.com/bounties/53308220-8b2e-492f-b248-0985b7c2db61, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0435.json, https://nvd.nist.gov/vuln/detail/CVE-2024-0435, https://github.com/mintplex-labs/anything-llm/commit/a4ace56a401ffc8ce0082d7444159dfd5dc28834

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a4ace56a401ffc8ce0082d7444159dfd5dc28834

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-0435 | CVE-DB