Read the docs
TI-2024-02263 Aliases CVE-2024-2435GHSA-8f25-w7qj-r7hc

Stored XSS in Timeline View

Priority LOW 20CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that signal. The XSS is in the timeline page displaying the workflow execution details of the workflow that was sent the crafted signal. Access to send a signal to a workflow is determined by how you configured the authorizer on your server. This includes any entity with permission to directly call SignalWorkflowExecution or SignalWithStartWorkflowExecution, or any entity can deploy a worker that has access to call workflow progress APIs (specifically RespondWorkflowTaskCompleted).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix Fixed ui-server (Temporal OSS): 2.25.0github.com/temporalio/ui-server/v2 (Go): 2.25.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Temporal OSSui-server2.16.2 to before 2.25.02.25.0Patch availableCNA
—github.com/temporalio/ui-server/v2 (Go)before 2.25.02.25.0Patch availableGHSA-8f25-w7qj-r7hc
  • ui-server VendorTemporal OSS Affected 2.16.2 to before 2.25.0 Fixed in 2.25.0 Patch available CNA
  • github.com/temporalio/ui-server/v2 (Go) Vendor— Affected before 2.25.0 Fixed in 2.25.0 Patch available GHSA-8f25-w7qj-r7hc

Remediation

  • Fix · CNA ui-server (Temporal OSS) Fixed in 2.25.0
  • Fix · GHSA-8f25-w7qj-r7hc github.com/temporalio/ui-server/v2 (Go) Fixed in 2.25.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2435
  2. 2026-10-03 Alias added: GHSA-8f25-w7qj-r7hc

References

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences