CVE-2024-2171

MEDIUM

zenml < 0.56.2 - Stored Cross-Site Scripting via Logo URL Field

Title source: llm
STIX 2.1

Description

A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.

References (2)

Core 2

Scores

CVSS v3 4.8
EPSS 0.0006
EPSS Percentile 19.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
pypi/zenml 0 - 0.56.2PyPI
zenml/zenml < 0.56.2
Published Jun 06, 2024
Tracked Since Feb 18, 2026