CVE-2024-9107— Stored XSS in gaizhenbiao/chuanhuchatgpt

EPSS 0.86% · P75 Updated Mar 21, 2025

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-9107

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Stored XSS in gaizhenbiao/chuanhuchatgpt

Source: NVD (National Vulnerability Database)

Vulnerability Description

A stored cross-site scripting (XSS) vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, affecting version git 20b2e02. The vulnerability arises from improper sanitization of HTML tags in chat history uploads. Specifically, the sanitization logic fails to handle HTML tags within code blocks correctly, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially leading to identity theft or other malicious actions.

Source: NVD (National Vulnerability Database)

CVSS Information

N/A

Source: NVD (National Vulnerability Database)

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: NVD (National Vulnerability Database)

Vulnerability Title

chuanhuchatgpt 跨站脚本漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

ChuanhuChatGPT是Chuan Hu个人开发者的一款应用程序。为 ChatGPT 等多种 LLM 提供了一个轻快好用的 Web 图形界面和众多附加功能 chuanhuchatgpt 20b2e02版本存在跨站脚本漏洞，该漏洞源于聊天历史上传中HTML标签清理不当，可能导致存储型跨站脚本攻击。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gaizhenbiao	gaizhenbiao/chuanhuchatgpt	unspecified ~ latest	-

II. Public POCs for CVE-2024-9107

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2024-9107

请登录查看更多情报信息。

Same Patch Batch · gaizhenbiao · 2025-03-20 · 10 CVEs total

CVE-2025-0191		Denial of Service in gaizhenbiao/chuanhuchatgpt
CVE-2025-0188		SSRF in gaizhenbiao/chuanhuchatgpt
CVE-2024-8400		Stored XSS in gaizhenbiao/chuanhuchatgpt
CVE-2024-8613		Improper Access Control in gaizhenbiao/chuanhuchatgpt
CVE-2024-10650		Denial of Service (DoS) in gaizhenbiao/chuanhuchatgpt
CVE-2024-10955		ReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgpt
CVE-2024-10707		Local File Inclusion in gaizhenbiao/chuanhuchatgpt
CVE-2024-9159		Incorrect Authorization in gaizhenbiao/chuanhuchatgpt
CVE-2024-9216		Authentication Bypass in gaizhenbiao/ChuanhuChatGPT

IV. Related Vulnerabilities

Same product: gaizhenbiao/chuanhuchatgpt

Same vendor: gaizhenbiao

Same weakness: CWE-79

V. Comments for CVE-2024-9107

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-9107— Stored XSS in gaizhenbiao/chuanhuchatgpt

I. Basic Information for CVE-2024-9107

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2024-9107

III. Intelligence Information for CVE-2024-9107

Same Patch Batch · gaizhenbiao · 2025-03-20 · 10 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2024-9107

Leave a comment