CVE-2024-8029 describes a medium-severity Cross-Site Scripting (XSS) vulnerability in imartinez/privategpt v0.5.0, specifically within the file upload process. Attackers can exploit this by uploading malicious SVG files, which execute JavaScript when a victim clicks the file link, potentially leading to data theft, session hijacking, or malware distribution. The CVSS score is 6.1 (MEDIUM), indicating a network-based attack requiring user interaction with low attack complexity. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.5.0CPE matchmatch criteria | cpe:2.3:a:pribai:privategpt:0.5.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.