I, Librarian has a Stored XSS vulnerability in Supplemental Files
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-80.
Summary
I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA i-librarian-free (mkucej) Fixed in 5.11.2
Timeline
- 2026-10-02 Threatist record created from CVE-2024-50344
References
More mkucej vulnerabilities
- TI-2024-27965 I, Librarian Stored XSS vulnerability in Item Summary CVSS 3.1MEDIUM 4.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences