CVE-2024-57783

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-57783

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57783.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-57783

Published

2025-06-02T00:00:00Z

Modified

2026-07-15T01:48:57.842847566Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.

Database specific

{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57783.json"
}

References

Affected packages

Git / github.com/alexpinel/dot

Affected ranges

Type

GIT

Repo

https://github.com/alexpinel/dot

Events

Introduced

Fixed

80cff8828bed8eb57d13c3cc4151bdfa00f0e263

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.9.3"
        },
        {
            "fixed": "0.9.3"
        }
    ]
}

Affected versions

v0.*

v0.9-beta

v0.9.1

v0.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57783.json"