TI-2026-11433 Aliases CVE-2026-13508 GHSA-5f46-vq6x-rmc9

khoj-ai khoj Conversation Sharing api_chat.py authorization

MEDIUM 56CWE-285Published 2026-06-28 · Updated 2026-06-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00286 21st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
khoj-ai	khoj	2.0.0-beta.0; 2.0.0-beta.1; 2.0.0-beta.2; 2.0.0-beta.3; 2.0.0-beta.4; 2.0.0-beta.5; 2.0.0-beta.6; 2.0.0-beta.7; 2.0.0-beta.8; 2.0.0-beta.9; 2.0.0-beta.10; 2.0.0-beta.11; 2.0.0-beta.12; 2.0.0-beta.13; 2.0.0-beta.14; 2.0.0-beta.15; 2.0.0-beta.16; 2.0.0-beta.17; 2.0.0-beta.18; 2.0.0-beta.19; 2.0.0-beta.20; 2.0.0-beta.21; 2.0.0-beta.22; 2.0.0-beta.23; 2.0.0-beta.24; 2.0.0-beta.25; 2.0.0-beta.26; 2.0.0-beta.27; 2.0.0-beta.28	—	No fix listed	CNA

khoj Vendorkhoj-ai Affected 2.0.0-beta.0; 2.0.0-beta.1; 2.0.0-beta.2; 2.0.0-beta.3; 2.0.0-beta.4; 2.0.0-beta.5; 2.0.0-beta.6; 2.0.0-beta.7; 2.0.0-beta.8; 2.0.0-beta.9; 2.0.0-beta.10; 2.0.0-beta.11; 2.0.0-beta.12; 2.0.0-beta.13; 2.0.0-beta.14; 2.0.0-beta.15; 2.0.0-beta.16; 2.0.0-beta.17; 2.0.0-beta.18; 2.0.0-beta.19; 2.0.0-beta.20; 2.0.0-beta.21; 2.0.0-beta.22; 2.0.0-beta.23; 2.0.0-beta.24; 2.0.0-beta.25; 2.0.0-beta.26; 2.0.0-beta.27; 2.0.0-beta.28 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:khoj-ai:khoj::::::::	—	—	—

cpe:2.3:a:khoj-ai:khoj:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-13508
2026-10-03 Alias added: GHSA-5f46-vq6x-rmc9

References

TI-2024-16867 Prompt Injection triggered XSS vulnerability in Khoj Obsidian, Desktop and Web clients CVSS 3.1HIGH 7.5
TI-2025-42661 Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning CVSS 3.1HIGH 7.1
TI-2024-34969 khoj has an IDOR in subscription management that allows unauthorized subscription modifications CVSS 3.1MEDIUM 4.3
TI-2024-29045 Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature) CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences