Open Generative Ai
Monthly
Stored cross-site scripting in Open-Generative-AI's studio history components (ImageStudio.js, CinemaStudio.js, LipSyncStudio.js, VideoStudio.js) allows an authenticated low-privileged user to inject arbitrary HTML and JavaScript into the history panel by crafting a malicious generation prompt or URL, which then executes in any victim's browser session when the history panel is viewed. Versions up to 1.0.11 and 2.0.0 are affected per CPE and VulDB reporting. No public exploit has been identified at time of analysis, and no KEV listing exists, but the technique is trivially reproducible given the unguarded innerHTML interpolation pattern visible in the patch diff.
Stored cross-site scripting in Open-Generative-AI's studio history components (ImageStudio.js, CinemaStudio.js, LipSyncStudio.js, VideoStudio.js) allows an authenticated low-privileged user to inject arbitrary HTML and JavaScript into the history panel by crafting a malicious generation prompt or URL, which then executes in any victim's browser session when the history panel is viewed. Versions up to 1.0.11 and 2.0.0 are affected per CPE and VulDB reporting. No public exploit has been identified at time of analysis, and no KEV listing exists, but the technique is trivially reproducible given the unguarded innerHTML interpolation pattern visible in the patch diff.