GHSA-3434-hc3m-8mmm: Reflected Cross-Site Scripting (XSS) in zenml

Skip to content

Navigation Menu

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • GitHub Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• • Enterprise platform

    AI-powered developer platform

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-5062

Reflected Cross-Site Scripting (XSS) in zenml

Moderate severity GitHub Reviewed Published Jun 30, 2024 to the GitHub Advisory Database • Updated Jul 1, 2024

Affected versions

= 0.57.1

Description

A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the ‘redirect’ parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user’s browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-5062
• zenml-io/zenml@21edd86
• https://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f

Published to the GitHub Advisory Database

Jun 30, 2024