Answer in brief
CVE-2025-24978 records a Low severity (CVSS 3.7) vulnerability in LF Edge eKuiper: Self-XSS in External Service Creation. The current sources do not mark it as known exploited. The current feed maps github.com/lf-edge/ekuiper/v2 (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 3.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps github.com/lf-edge/ekuiper/v2 (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/lf-edge/ekuiper/v2go | <2.4.0 | 2.4.0 |
Published upstream
Sep 9, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Sep 9, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Sep 9, 2026
### Summary A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. ### Details Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as `<iframe src="...">`). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user's browser session. ### PoC 1. Create an external service JSON definition with a filename containing an XSS payload, e.g. `<iframe src="javascript:alert`1337`">.json` inside a ZIP archive. 2. In external service creation, upload the ZIP and provide the matching service name: `<iframe src="javascript:alert`1337`">`. 3. Upon service registration, the unescaped name executes when rendered in the UI context. ### Impact Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user's browser session. ### Remediation & Patches - **Upgrade to eKuiper >= 2.4.0**: Strict alphanumeric identifier validation (`validate.ValidateID`) is now enforced on all external service creation and update endpoints, rejecting invalid characters. ### Workarounds - Protect eKuiper management endpoints (`POST /services`) with authentication and network-level firewalls. ### Credits - Reported by Alexey Kosmachev, Bi.Zone (@TheMostKnown)
Quoted source text, attributed separately from HOL analysis.