CVE-2024-37743 Details
Description
An issue in mmzdev KnowledgeGPT V.0.0.5 allows a remote attacker to execute arbitrary code via the Document Display Component.
A remote code execution vulnerability exists in mmzdev KnowledgeGPT version 0.0.5. The issue arises in the Document Display Component, which uses the st.markdown function with the unsafe_allow_html parameter enabled, allowing for the execution of arbitrary code. This vulnerability is compounded by inadequate validation of uploaded files, enabling attackers to upload files containing malicious code that is executed within the application's context.
Users are advised to avoid using the unsafe_allow_html parameter in st.markdown whenever possible. If it must be used, implement proper HTML sanitization to remove potentially harmful scripts. KnowledgeGPT users should also be cautious, as the repository is archived and may not be actively maintained.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mmz-001 knowledgegpt | 0.0.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2025 | Initial Analysis | [email protected] |
| Jun 24, 2025 | New CVE Received | [email protected] |
| Jun 24, 2025 | CVE Modified | CISA-ADP |