CVE-2024-57783 | THREATINT

Description

The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.

Reserved 2025-01-09 | Published 2025-06-02 | Updated 2025-06-02 | Assigner mitre

HIGH: 8.1CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status

unknown

Any version

affected

References

github.com/alexpinel/Dot/issues/28

github.com/...ulnerability-Research/tree/main/CVE-2024-57783

dotapp.uk

cve.org (CVE-2024-57783)

nvd.nist.gov (CVE-2024-57783)

Download JSON