Read the docs

danswer-ai

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

danswer-ai records in CISA KEV

No danswer-ai vulnerabilities are listed in CISA KEV.

Records

9 records

TI-2024-07378 CVE-2024-7957 · GHSA-q6gg-j289-2hm4

Arbitrary File Overwrite in danswer-ai/danswer

Priority HIGH 78

An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00952 Published 2025-03-20 No fix listed CWE-29
TI-2025-00141 CVE-2025-0182 · GHSA-vrw3-r7jw-4785

Denial of Service in danswer-ai/danswer

Priority HIGH 72

A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00719 Published 2025-03-20 No fix listed CWE-770
TI-2024-07442 CVE-2024-8028 · GHSA-4vm5-r6m3-2448

Denial of Service in danswer-ai/danswer

Priority HIGH 72

A vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00529 Published 2025-03-20 No fix listed CWE-770
TI-2024-07212 CVE-2024-7779 · GHSA-4f3h-89pj-w84f

ReDoS (Regular Expression Denial of Service) in danswer-ai/danswer

Priority HIGH 72

A vulnerability in danswer-ai/danswer version 1 allows an attacker to perform a Regular Expression Denial of Service (ReDoS) by manipulating regular expressions.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00719 Published 2025-03-20 No fix listed CWE-1333
TI-2024-07477 CVE-2024-8065 · GHSA-f64v-mwpx-gv6x

CSRF in danswer-ai/danswer

Priority HIGH 68

A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser.

CVSS 3.0HIGH 8.1 Network No auth User interaction EPSS 0.00213 Published 2025-03-20 No fix listed CWE-352
TI-2024-07246 CVE-2024-7819 · GHSA-2c36-wq4v-5v3h

CORS Misconfiguration in danswer-ai/danswer

Priority HIGH 66

A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data.

CVSS 3.0HIGH 7.4 Network No auth User interaction EPSS 0.00283 Published 2025-03-20 No fix listed CWE-346
TI-2024-08922 CVE-2024-9617 · GHSA-2w2q-qp7m-7wrh

IDOR in danswer-ai/danswer

Priority MEDIUM 62

An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01722 Published 2025-03-20 No fix listed CWE-639
TI-2024-07471 CVE-2024-8057 · GHSA-fgqc-p7g9-x92w

Improper Access Control in danswer-ai/danswer

Priority MEDIUM 53

In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connector.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00417 Published 2025-03-20 No fix listed CWE-306
Open these records in search →