khoj-assistant (>=0.1.0, <=0.3.0a1676209086), pyconverse (0.1.0) +1 more potentially affected by CVE-2026-68770 via sentence-transformers (2.1.0)

sentence-transformers PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - khoj-assistant =0.1.0, =0.0.3, =0.0.6 Source cves: CVE-2026-68770 Source advisory: OSV:PYSEC-2026-4164...

askdoc (0.1.1), conflare (>=0.1.2, <=0.1.3) +6 more potentially affected by CVE-2026-68770 via sentence-transformers (2.3.1)

sentence-transformers PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - askdoc 0.1.1 - conflare =0.1.2, =0.1.9, =1.5.2.dev14, =0.1.0, =0.7.0 - raga-llm-eval 1.0.0 - team-comm-tools 0.1.0...

khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

Summary The /home/filepath:path endpoint in webclient.py serves static files by directly concatenating the user-supplied filepath with the homedirectory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequences t...

GHSA-62MM-XWMV-CRHG khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

Summary The /home/filepath:path endpoint in webclient.py serves static files by directly concatenating the user-supplied filepath with the homedirectory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequences t...

PT-2026-106309

Summary The /home/file path:path endpoint in web client.py serves static files by directly concatenating the user-supplied file path with the home directory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequenc...

khoj-assistant (>=0.1.0, <=0.3.0a1676209086), lama-cleaner (>=0.24.0, <=0.29.1) +1 more potentially affected by CVE-2026-9856 via transformers (4.21.0)

transformers PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - khoj-assistant =0.1.0, =0.24.0, =0.29.1 - med-clip-weixiong 0.0.5 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...

khoj-assistant (>=0.1.0, <=0.3.0a1676209086), lama-cleaner (>=0.24.0, <=0.29.1) +1 more potentially affected by CVE-2026-9856 via transformers (4.21.0)

transformers PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - khoj-assistant =0.1.0, =0.24.0, =0.29.1 - med-clip-weixiong 0.0.5 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

khoj-assistant (>=0.1.0, <=0.3.0a1676209086), pyconverse (0.1.0) +1 more potentially affected by CVE-2026-68770 via sentence-transformers (2.1.0)

sentence-transformers PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - khoj-assistant =0.1.0, =0.0.3, =0.0.6 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

Khoj - Detect

Khoj was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Khoj was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Khoj - Detect', 'description': 'Khoj was detected.', 'author': 'KittySploit Team',...

khoj-assistant (>=1.21.0, <=1.21.1) potentially affected by CVE-2025-69207 via khoj (1.42.10)

khoj PYPI version 1.42.10 is affected by a known vulnerability. The following packages have a transitive dependency on khoj and may be impacted: - khoj-assistant =1.21.0, =1.21.1 Source cves: CVE-2025-69207 Source advisory: OSV:PYSEC-2026-1491...

PYSEC-2026-1492 Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)

Summary The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. Details The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary...

EUVD-2026-40005

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/apichat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack...

CVE-2026-13508

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/apichat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack...

CVE-2026-13508 khoj-ai khoj Conversation Sharing api_chat.py authorization

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/apichat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack...

CVE-2026-13508

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/apichat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack...

CVE-2026-13508 khoj-ai khoj Conversation Sharing api_chat.py authorization

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/apichat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack...

CVE-2026-13508

Affects khoj-ai khoj versions up to 2.0.0-beta.28; vulnerable component is the Conversation Sharing Handler in src/khoj/routers/api_chat.py, where manipulation of conversation.agent leads to incorrect authorization. The issue enables remote exploitation (exploit published) with attack vector over...

CVE-2026-13508 khoj-ai khoj Conversation Sharing api_chat.py authorization

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/apichat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack...

CVE-2026-13508

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/apichat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack...

CVE-2026-13508: Incorrect Authorization

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/apichat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack...