Skip to content
OpenAdvisories

Package · PyPI

khoj

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.4
    CVE-2025-69207

    Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning

    Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID witho…

    khoj-ai khoj khoj PyPI
  • Medium 4.3
    CVE-2024-52294

    khoj has an IDOR in subscription management that allows unauthorized subscription modifications

    Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply…

    khoj-ai khoj khoj PyPI
  • Medium 5.4
    CVE-2024-43396

    Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)

    Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized wh…

    khoj-ai khoj khoj PyPI