Home

Description

The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.

PUBLISHED Reserved 2025-01-09 | Published 2025-06-02 | Updated 2025-06-02 | Assigner mitre




HIGH: 8.1CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unknown

Any version
affected

References

github.com/alexpinel/Dot/issues/28

github.com/...ulnerability-Research/tree/main/CVE-2024-57783

dotapp.uk

cve.org (CVE-2024-57783)

nvd.nist.gov (CVE-2024-57783)

Download JSON