Skip to main content

Kotaemon

4 CVEs product

Monthly

CVE-2026-69098 CRITICAL POC Act Now

Remote code execution in kotaemon (Cinnamon) versions through 0.12.0 allows unauthenticated attackers to run arbitrary commands via the check_connection endpoint, which insecurely deserializes attacker-supplied YAML/JSON. By setting the __type__ field to subprocess.check_output with chosen arguments, an attacker instantiates arbitrary Python objects and executes OS commands with the application's process privileges. Publicly available exploit code exists (VulnCheck advisory and upstream issue), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as actively exploited.

RCE Python Deserialization Kotaemon
NVD GitHub
CVSS 4.0
9.3
EPSS
0.5%
CVE-2025-63914 MEDIUM POC This Month

An issue was discovered in Cinnamon kotaemon 0.11.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Information Disclosure Kotaemon
NVD GitHub
CVSS 3.1
6.5
EPSS
0.1%
CVE-2025-56527 HIGH POC PATCH This Month

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Information Disclosure Kotaemon
NVD GitHub
CVSS 3.1
7.5
EPSS
0.1%
CVE-2025-56526 MEDIUM POC PATCH This Month

Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

RCE XSS Kotaemon
NVD GitHub
CVSS 3.1
6.1
EPSS
0.1%
EPSS 1% CVSS 9.3
CRITICAL POC Act Now

Remote code execution in kotaemon (Cinnamon) versions through 0.12.0 allows unauthenticated attackers to run arbitrary commands via the check_connection endpoint, which insecurely deserializes attacker-supplied YAML/JSON. By setting the __type__ field to subprocess.check_output with chosen arguments, an attacker instantiates arbitrary Python objects and executes OS commands with the application's process privileges. Publicly available exploit code exists (VulnCheck advisory and upstream issue), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as actively exploited.

RCE Python Deserialization +1
NVD GitHub
EPSS 0% CVSS 6.5
MEDIUM POC This Month

An issue was discovered in Cinnamon kotaemon 0.11.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Information Disclosure Kotaemon
NVD GitHub
EPSS 0% CVSS 7.5
HIGH POC PATCH This Month

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Information Disclosure Kotaemon
NVD GitHub
EPSS 0% CVSS 6.1
MEDIUM POC PATCH This Month

Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

RCE XSS Kotaemon
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy