low

CVE-2025-24978

Go · github.com/lf-edge/ekuiper/v2

Summary

LF Edge eKuiper: Self-XSS in External Service Creation

Severity
low
CVSS
3.7
CWE
CWE-79
Also known as
GHSA-g8rh-fjm6-h2h9
Published
2026-09-09
Updated
2026-09-09

Advisory details

Summary

A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces.

Details

Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as <iframe src="...">). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user's browser session.

PoC

  1. Create an external service JSON definition with a filename containing an XSS payload, e.g. <iframe src="javascript:alert1337">.json inside a ZIP archive.
  2. In external service creation, upload the ZIP and provide the matching service name: <iframe src="javascript:alert1337">.
  3. Upon service registration, the unescaped name executes when rendered in the UI context.

Impact

Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user's browser session.

Remediation & Patches

Workarounds

Credits

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.