XSS in Alexpinel Dot
CVE-2024-57783
The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (8.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Alexpinel Dot — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-57783?
- CVE-2024-57783 is a high-severity vulnerability in Alexpinel Dot, classified under Cross-site Scripting. CVSS score: 8.1/10. Published 2025-06-02.
- How severe is CVE-2024-57783?
- High severity. CVSS v3 base score is 8.1 out of 10.