CVE-2023-5562

KNIME Analytics Platform before 5.2.0 is vulnerable to cross-site scripting when used as an executor for KNIME Server or KNIME Business Hub. The root cause is an unsafe default configuration where JavaScript-based view nodes do not sanitize data by default, allowing inline JavaScript to run in th...

CVE-2022-31500

CVE-2022-31500 affects KNIME Analytics Platform prior to 4.6.0. The root cause is an improper filesystem permission setting in the Windows installer, which could expose sensitive files/functions due to insufficient access restrictions. The vulnerability is tied to the Windows installer behavior r...

CVE-2022-44749

CVE-2022-44749 affects KNIME Analytics Platform 3.2.0 and later via a directory traversal in ZIP extraction (Zip-Slip). An attacker can craft a KNIME workflow that, when opened by a user, overwrites arbitrary files the user can write to, with the user only needing to open the workflow (no executi...

CVE-2021-45096

KNIME Analytics Platform (KNIME) is affected by CVE-2021-45096: versions prior to 4.5.0 are vulnerable to XXE (external XML entity injection) via crafted workflow files (.knwf). The root cause is an XXE vulnerability in processing knwf workflows, enabling an attacker to inject external entities. ...