XSS in Serge-Chat Serge-Chat/serge
CVE-2024-11441
A stored cross-site scripting (XSS) vulnerability exists in Serge version 0.9.0. The vulnerability is due to improper neutralization of input during web page generation in the chat prompt. An attacker can exploit this vulnerability by sending a crafted message containing malicious HTML/JavaScript code, which will be stored and executed whenever the chat is accessed, leading to unintended content being shown to the user and potential phishing attacks.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (29.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Serge-chat Serge-chat/serge — versions unspecified
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-11441?
- CVE-2024-11441 is a medium-severity vulnerability in Serge-Chat Serge-Chat/serge, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-03-20.
- How severe is CVE-2024-11441?
- Medium severity. CVSS v3 base score is 6.1 out of 10.