What is the CVSS score of CVE-2024-57783?

CVE-2024-57783 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2024-57783?

Dot desktop application versions through 0.9.3 contain a critical vulnerability allowing attackers to execute arbitrary commands on user systems through cross-site scripting attacks.

How to fix or mitigate CVE-2024-57783?

Within 24 hours: Identify all systems running Dot application and isolate them from sensitive networks; notify affected users to stop using the application immediately. Within 7 days: Assess whether business-critical workflows depend on Dot and develop alternative solutions; document all systems that were potentially compromised. Within 30 days: Establish a vendor communication plan to track patch availability; evaluate replacement applications with stronger security postures; conduct forensic analysis on affected systems for signs of exploitation.

Node.js CVE-2024-57783

EUVD-2024-54618 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-02 cve@mitre.org

XSS Node.js

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2024-54618

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 14:15 nvd

HIGH 8.1

DescriptionCVE.org

The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.

AnalysisAI

Cross-site scripting (XSS) vulnerability in Dot desktop application (versions through 0.9.3) that allows unauthenticated local attackers to execute arbitrary commands with high complexity due to unsafe DOM manipulation via innerHTML. The vulnerability chains user input and LLM output directly into the DOM without sanitization, combined with Electron's Node.js API access, enabling command execution. This is a local attack vector with high impact on confidentiality, integrity, and availability.

Technical ContextAI

The vulnerability exists in render.js where both user-supplied input and Large Language Model (LLM) generated output are directly appended to the DOM using the innerHTML property. This violates secure coding practices for XSS prevention (CWE-79: Improper Neutralization of Input During Web Page Generation). The root cause is the absence of input validation, output encoding, and Content Security Policy (CSP) enforcement. The Electron framework, while providing cross-platform desktop capabilities, compounds the risk by enabling renderer processes to access Node.js APIs (require statements, child_process module), which transforms what would be a traditional web XSS into a local code execution vulnerability. The attack surface includes any user input fields that feed LLM prompts and any LLM responses rendered to the UI. CPE for affected product: cpe:2.3:a:dot:dot:*:*:*:*:*:*:*:* (versions <= 0.9.3).

RemediationAI

Upgrade to Dot version 0.9.4 or later (specific patch version not disclosed in CVE; check official Dot GitHub repository or releases page); priority: Critical Code-Level Mitigation: Replace innerHTML usage with textContent or innerText for user-controlled and LLM output data in render.js. If HTML rendering is required, use a safe HTML sanitization library such as DOMPurify or xss.js with strict allowlists. Security Hardening: Implement Content Security Policy (CSP) headers in Electron webPreferences to disable inline scripts and restrict script sources. Set sandbox: true and disable nodeIntegration in BrowserWindow configuration. Architecture Change: Separate renderer process from main process by using preload scripts and IPC (inter-process communication) rather than direct Node.js API access from renderer. This limits privilege escalation from XSS. Input Validation: Implement strict input validation and sanitization on all user-supplied data before rendering. Use allowlists for expected input formats. Workaround: If immediate patching is not possible, avoid processing untrusted or adversarial LLM outputs and disable features that accept complex user input in Dot until patched.