Youdao's vulnerability footprint centers on QAnything, a document-analysis and retrieval application, with observed weaknesses concentrated in web-layer input handling and HTTP-protocol interpretation flaws such as path traversal, cross-site scripting, HTTP request smuggling, and origin validation errors. The recurring pattern reflects the attack surface inherent to a web-facing service that processes user-supplied input and parses HTTP requests; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Youdao over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-10264CRITICAL HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy an | Mar 20, 2025 | 9.8 | 26 | NO | NO |
CVE-2024-12866HIGH A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can | Mar 20, 2025 | 7.5 | 21 | NO | NO |
CVE-2024-8024HIGH A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an attacker to bypass the Same-Origin Policy, potentially leading | Mar 20, 2025 | 7.5 | 20 | NO | NO |
CVE-2024-12864HIGH A Denial of Service (DoS) vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2.0.0. The vulnerability is due to improper handling of form- | Mar 20, 2025 | 7.5 | 20 | NO | NO |
CVE-2024-8027MEDIUM A stored Cross-Site Scripting (XSS) vulnerability exists in netease-youdao/QAnything. Attackers can upload malicious knowledge files to the knowledge base, which can trigger XSS at | Mar 20, 2025 | 6.1 | 18 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Youdao.
Media articles that mention a CVE ID that affects a product developed by Youdao — matched by CVE ID, not by vendor name.