Vulnerability Description
The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://dotapp.uk
- https://github.com/EDMPL/Vulnerability-Research/tree/main/CVE-2024-57783
- https://github.com/alexpinel/Dot/issues/28
FAQ
What is CVE-2024-57783?
CVE-2024-57783 is a vulnerability with a CVSS score of 8.1 (HIGH). The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electro...
How severe is CVE-2024-57783?
CVE-2024-57783 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-57783?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.