Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-8029Stored XSS in imartinez/privategpt
Medium 4.7
In plain English
A medium-severity cross-site scripting in imartinez/privategpt from imartinez. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.0)4.7Medium
Exploit odds (30 days)0.4%top 70.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An XSS vulnerability was discovered in the upload file(s) process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| imartinez | imartinez/privategpt | unspecified – through latest |
Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N