CVE-2024-57783

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-57783
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57783.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-57783
Published
2025-06-02T14:15:21.170Z
Modified
2026-03-15T14:51:47.105221Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.

References

Affected packages

Git / github.com/alexpinel/Dot

Affected ranges

Type
GIT
Repo
https://github.com/alexpinel/Dot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
80cff8828bed8eb57d13c3cc4151bdfa00f0e263
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.9.3"
        }
    ]
}

Affected versions

v0.*
v0.9-beta
v0.9.1
v0.9.2
v0.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57783.json"