Medium severity · published Mar 20, 2025
CVE-2024-8029
Stored XSS in imartinez/privategpt
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
An XSS vulnerability was discovered in the upload file(s) process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
imartinez/privategpt · imartinez
through latest · source: vendor
PR
Privategpt · Pribai
0.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8029
Exploit
https://huntr.com/bounties/5941dc63-a4db-4b04-8007-bcaa828106d0
More from imartinez/privategpt
9.8
CVE-2024-4343
Python Command Injection in imartinez/privategpt
7.5
CVE-2024-12063
Denial of Service in imartinez/privategpt
7.5
CVE-2024-8018
Denial of Service (DOS) in imartinez/privategpt
7.5
CVE-2024-3403
Local File Inclusion in imartinez/privategpt
7.2
CVE-2024-5186
Server Side Request Forgery (SSRF) in imartinez/privategpt