Vulnerability · Published Jul 11, 2024 · Assigned by @huntr_ai

CVE-2024-6035Stored XSS in gaizhenbiao/chuanhuchatgpt

High 7.4

In plain English

A high-severity cross-site scripting in gaizhenbiao/chuanhuchatgpt from gaizhenbiao. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.0)7.4High

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	chuanhuchatgpt	no fix listed	PYSEC-2024-61

Affected products (as reported)

Vendor	Product	Versions
gaizhenbiao	gaizhenbiao/chuanhuchatgpt	unspecified – through latest

Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

https://huntr.com/bounties/e4e8da71-53a9-4540-8d70-6b670b076987