CVE-2025-24978

LF Edge eKuiper: Self-XSS in External Service Creation

CVSS_V3 Publisher rating LOWFixed by github.com/lf-edge/ekuiper/v2 2.4.0osv · severity unknownFixed by github.com/lf-edge/ekuiper/v2 2.4.0KEV status unknown

Original advisory

osv · GHSA-g8rh-fjm6-h2h9

Published

### Summary A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. ### Details Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as `<iframe src="...">`). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user's browser session. ### PoC 1. Create an external service JSON definition with a filename containing an XSS payload, e.g. `<iframe src="javascript:alert`1337`">.json` inside a ZIP archive. 2. In external service creation, upload the ZIP and provide the matching service name: `<iframe src="javascript:alert`1337`">`. 3. Upon service registration, the unescaped name executes when rendered in the UI context. ### Impact Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user's browser session. ### Remediation & Patches - **Upgrade to eKuiper >= 2.4.0**: Strict alphanumeric identifier validation (`validate.ValidateID`) is now enforced on all external service creation and update endpoints, rejecting invalid characters. ### Workarounds - Protect eKuiper management endpoints (`POST /services`) with authentication and network-level firewalls. ### Credits - Reported by Alexey Kosmachev, Bi.Zone (@TheMostKnown)

Read the publisher's advisory

osv · GO-2026-6446

Published

LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper

Read the publisher's advisory

Affected versions, risk and source history

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Risk history

Compare earlier KEV listings and daily EPSS scores. Advisory wording and affected versions have a separate history.

When does an EPSS score appear as a change?

A prediction change is reported when EPSS rises from below 10% to 10% or higher. Other daily score changes remain in this history.

Advisory history

2 saved versions

See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.

How advisory history works

Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.

24 Oct 2026 13:19:41 UTC