CVE-2025-56526
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in Kotaemon 0.11.0 allows attackers to inject malicious scripts via crafted PDF content. When rendered by the application, this can execute arbitrary JavaScript in victims' browsers. Users of Kotaemon 0.11.0 are affected.
💻 Affected Systems
- Kotaemon
📦 What is this software?
Kotaemon by Cinnamon
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware via drive-by downloads.
Likely Case
Session hijacking, credential theft, and unauthorized actions within the application context.
If Mitigated
Limited to same-origin policy restrictions; impact depends on application permissions and user privileges.
🎯 Exploit Status
Exploitation requires uploading a malicious PDF; public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 37cdc28
Vendor Advisory: https://github.com/Cinnamon/kotaemon/commit/37cdc28
Restart Required: No
Instructions:
1. Update Kotaemon to version with commit 37cdc28. 2. Ensure PDF content is properly sanitized before rendering. 3. Review and apply security patches from the repository.
🔧 Temporary Workarounds
Disable PDF uploads
allTemporarily disable PDF upload functionality in Kotaemon.
Modify application configuration to reject PDF file uploads.
Implement Content Security Policy
allAdd CSP headers to restrict script execution from untrusted sources.
Add 'Content-Security-Policy' header with appropriate directives in web server configuration.
🧯 If You Can't Patch
- Implement strict input validation and output encoding for PDF content.
- Use web application firewall (WAF) rules to block malicious PDF uploads.
🔍 How to Verify
Check if Vulnerable:
Check if running Kotaemon 0.11.0; test PDF upload with script payloads to see if executed.Check Version:
Check package.json or application metadata for version information.Verify Fix Applied:
Verify application version includes commit 37cdc28; test PDF upload with script payloads to confirm no execution.📡 Detection & Monitoring
Log Indicators:
- Unusual PDF uploads, large file sizes, or suspicious filenames in application logs.
Network Indicators:
- HTTP requests with PDF uploads containing script-like patterns.
SIEM Query:
source="kotaemon_logs" AND (file_extension="pdf" AND (payload CONTAINS "<script>" OR payload CONTAINS "javascript:"))🔗 References
- https://github.com/Cinnamon/kotaemon
- https://github.com/Cinnamon/kotaemon/commit/37cdc28
- https://github.com/HanTul/Kotaemon-CVE-2025-56526-56527-disclosure
- https://harvest-sink-590.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-236770c3fe1e80f6a1aef381fb1c8f73
- https://skinny-exoplanet-584.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-22cd1563bd3380458588eb49f361a363
