danswer-ai — Vulnerabilities & Security Advisories 11

Danswer-ai is an open-source search platform for internal knowledge bases and document retrieval. Historically, it has been vulnerable to multiple remote code execution (RCE) flaws, cross-site scripting (XSS), and privilege escalation issues, with 11 CVEs recorded to date. Notable security characteristics include its reliance on third-party dependencies and frequent exposure of sensitive endpoints. The platform has experienced multiple critical vulnerabilities affecting authentication and data access, though no major public security incidents have been widely reported. Its architecture presents several attack surfaces, particularly in API integrations and user authentication mechanisms.